Mimante/Mimante/Pages/Account/Login.cshtml.cs

using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.RazorPages;
using AutoBidder.Models;

namespace AutoBidder.Pages.Account;

public class LoginModel : PageModel
{
    private readonly SignInManager<ApplicationUser> _signInManager;
    private readonly UserManager<ApplicationUser> _userManager;

    public LoginModel(SignInManager<ApplicationUser> signInManager, UserManager<ApplicationUser> userManager)
    {
        _signInManager = signInManager;
        _userManager = userManager;
    }

    [BindProperty]
    public string Username { get; set; } = string.Empty;

    [BindProperty]
    public string Password { get; set; } = string.Empty;

    [BindProperty]
    public bool RememberMe { get; set; }

    public string? ErrorMessage { get; set; }

    [FromQuery(Name = "returnUrl")]
    public string? ReturnUrl { get; set; }

    public async Task<IActionResult> OnGetAsync()
    {
        // Se già autenticato, vai alla home
        if (User.Identity?.IsAuthenticated == true)
        {
            return LocalRedirect(GetSafeReturnUrl());
        }

        // Logout eventuali sessioni precedenti
        await HttpContext.SignOutAsync(IdentityConstants.ApplicationScheme);

        return Page();
    }

    public async Task<IActionResult> OnPostAsync()
    {
        if (string.IsNullOrEmpty(Username) || string.IsNullOrEmpty(Password))
        {
            ErrorMessage = "Inserisci username e password.";
            return Page();
        }

        var result = await _signInManager.PasswordSignInAsync(
            Username,
            Password,
            RememberMe,
            lockoutOnFailure: true
        );

        if (result.Succeeded)
        {
            return LocalRedirect(GetSafeReturnUrl());
        }

        if (result.IsLockedOut)
        {
            ErrorMessage = "Account bloccato. Riprova tra qualche minuto.";
        }
        else
        {
            ErrorMessage = "Username o password non validi.";
        }

        return Page();
    }

    private string GetSafeReturnUrl()
    {
        // Ritorna solo URL locali sicuri
        if (!string.IsNullOrEmpty(ReturnUrl) && Url.IsLocalUrl(ReturnUrl))
        {
            return ReturnUrl;
        }
        return "/";
    }
}