Misc updates

Author: BenjaminMichaelis

EssentialCSharp.Chat.Shared/Services/AIChatService.cs

@@ -86,16 +86,13 @@ public AIChatService(IOptions<AIOptions> options, AISearchService searchService,
         var enrichedPrompt = await EnrichPromptWithContext(prompt, enableContextualSearch, cancellationToken);
 
         // Construct the user input with system context if provided
-        var systemContext = systemPrompt ?? _Options.SystemPrompt;
+        var systemContext = !string.IsNullOrWhiteSpace(systemPrompt) ? systemPrompt : _Options.SystemPrompt;
 
         // Create the streaming response using the Responses API
 #pragma warning disable OPENAI001 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.
-        List<ResponseItem> responseItems = [ResponseItem.CreateUserMessageItem(enrichedPrompt)];
-        if (systemContext is not null)
-        {
-            responseItems.Add(
-                ResponseItem.CreateSystemMessageItem(systemContext));
-        }
+        List<ResponseItem> responseItems = systemContext is not null
+            ? [ResponseItem.CreateSystemMessageItem(systemContext), ResponseItem.CreateUserMessageItem(enrichedPrompt)]
+            : [ResponseItem.CreateUserMessageItem(enrichedPrompt)];
 #pragma warning restore OPENAI001 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.
         var streamingUpdates = _ResponseClient.CreateResponseStreamingAsync(
             responseItems,
@@ -319,16 +316,13 @@ private static async Task<ResponseCreationOptions> CreateResponseOptionsAsync(
         CancellationToken cancellationToken = default)
     {
         // Construct the user input with system context if provided
-        var systemContext = systemPrompt ?? _Options.SystemPrompt;
+        var systemContext = !string.IsNullOrWhiteSpace(systemPrompt) ? systemPrompt : _Options.SystemPrompt;
 
         // Create the streaming response using the Responses API
 #pragma warning disable OPENAI001 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.
-        List<ResponseItem> responseItems = [ResponseItem.CreateUserMessageItem(prompt)];
-        if (systemContext is not null)
-        {
-            responseItems.Add(
-                ResponseItem.CreateSystemMessageItem(systemContext));
-        }
+        List<ResponseItem> responseItems = systemContext is not null
+            ? [ResponseItem.CreateSystemMessageItem(systemContext), ResponseItem.CreateUserMessageItem(prompt)]
+            : [ResponseItem.CreateUserMessageItem(prompt)];
 #pragma warning restore OPENAI001 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.
 
         // Create the response using the Responses API

EssentialCSharp.Web/Areas/Identity/Pages/Account/ExternalLogin.cshtml.cs

@@ -71,6 +71,10 @@ public async Task<IActionResult> OnGetCallbackAsync(string? returnUrl = null, st
         }
 
         // Sign in the user with this external login provider if the user already has a login.
+        // bypassTwoFactor: true is intentional — OAuth providers (GitHub, Microsoft) handle their own
+        // authentication including any provider-side MFA. The app's local TOTP 2FA is designed to protect
+        // the password-based sign-in path only. If policy changes to require local 2FA for all sign-in
+        // methods, set bypassTwoFactor to false AND add a RequiresTwoFactor redirect handler here.
         Microsoft.AspNetCore.Identity.SignInResult result = await signInManager.ExternalLoginSignInAsync(info.LoginProvider, info.ProviderKey, isPersistent: false, bypassTwoFactor: true);
         if (result.Succeeded)
         {

EssentialCSharp.Web/Areas/Identity/Pages/Account/LoginWith2fa.cshtml.cs

@@ -26,7 +26,7 @@ public InputModel Input
     public class InputModel
     {
         [Required]
-        [StringLength(ValidationMessages.VerificationCodeMaximumLength, ErrorMessage = ValidationMessages.StringLengthErrorMessage, MinimumLength = ValidationMessages.VerificationCodeMaximumLength)]
+        [StringLength(ValidationMessages.VerificationCodeMaximumLength, ErrorMessage = ValidationMessages.StringLengthErrorMessage, MinimumLength = ValidationMessages.VerificationCodeMinimumLength)]
         [DataType(DataType.Text)]
         [Display(Name = "Authenticator code")]
         public string? TwoFactorCode { get; set; }

EssentialCSharp.Web/Controllers/ChatController.cs

@@ -24,21 +24,17 @@ public ChatController(ILogger<ChatController> logger, AIChatService aiChatServic
     [HttpPost("message")]
     public async Task<IActionResult> SendMessage([FromBody] ChatMessageRequest request, CancellationToken cancellationToken = default)
     {
-        if (string.IsNullOrWhiteSpace(request.Message))
-        {
+        request.Message = request.Message.Trim();
+        if (string.IsNullOrEmpty(request.Message))
             return BadRequest(new { error = "Message cannot be empty." });
-        }
 
-        // Require user authentication for chat
-        if (!User.Identity?.IsAuthenticated ?? true)
-        {
-            return Unauthorized(new { error = "User must be logged in to use chat." });
-        }
+        var previousResponseId = string.IsNullOrWhiteSpace(request.PreviousResponseId)
+            ? null
+            : request.PreviousResponseId.Trim();
 
         var (response, responseId) = await _AiChatService.GetChatCompletion(
             prompt: request.Message,
-            systemPrompt: request.SystemPrompt,
-            previousResponseId: request.PreviousResponseId,
+            previousResponseId: previousResponseId,
             enableContextualSearch: request.EnableContextualSearch,
             cancellationToken: cancellationToken);
 
@@ -53,20 +49,17 @@ public async Task<IActionResult> SendMessage([FromBody] ChatMessageRequest reque
     [HttpPost("stream")]
     public async Task StreamMessage([FromBody] ChatMessageRequest request, CancellationToken cancellationToken = default)
     {
-        if (string.IsNullOrWhiteSpace(request.Message))
+        request.Message = request.Message.Trim();
+        if (string.IsNullOrEmpty(request.Message))
         {
             Response.StatusCode = 400;
-            await Response.WriteAsync(JsonSerializer.Serialize(new { error = "Message cannot be empty." }), cancellationToken);
+            await Response.WriteAsJsonAsync(new { error = "Message cannot be empty." }, CancellationToken.None);
             return;
         }
 
-        // Require user authentication for chat
-        if (!User.Identity?.IsAuthenticated ?? true)
-        {
-            Response.StatusCode = 401;
-            await Response.WriteAsync(JsonSerializer.Serialize(new { error = "User must be logged in to use chat." }), cancellationToken);
-            return;
-        }
+        var previousResponseId = string.IsNullOrWhiteSpace(request.PreviousResponseId)
+            ? null
+            : request.PreviousResponseId.Trim();
 
         Response.ContentType = "text/event-stream";
         Response.Headers.CacheControl = "no-cache";
@@ -76,8 +69,7 @@ public async Task StreamMessage([FromBody] ChatMessageRequest request, Cancellat
         {
             await foreach (var (text, responseId) in _AiChatService.GetChatCompletionStream(
                 prompt: request.Message,
-                systemPrompt: request.SystemPrompt,
-                previousResponseId: request.PreviousResponseId,
+                previousResponseId: previousResponseId,
                 enableContextualSearch: request.EnableContextualSearch,
                 cancellationToken: cancellationToken))
             {

EssentialCSharp.Web/Controllers/ChatMessageRequest.cs

@@ -1,9 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
 namespace EssentialCSharp.Web.Controllers;
 
 public class ChatMessageRequest
 {
+    [Required]
+    [StringLength(500)]
     public string Message { get; set; } = string.Empty;
-    public string? SystemPrompt { get; set; }
+    [StringLength(200)]
     public string? PreviousResponseId { get; set; }
     public bool EnableContextualSearch { get; set; } = true;
     public string? CaptchaResponse { get; set; } // For future captcha implementation