feat: implement automated account enforcement service with RADIUS disconnect capabilities and add RADIUS management service

radiuscontroller/Services/RadiusService.cs

@@ -272,17 +272,18 @@ public class RadiusService : IRadiusService
 
         profile.Status = "Revoked";
 
-        // Remove Cleartext-Password and insert Auth-Type := Reject
-        var checks = await _db.RadCheck.Where(rc => rc.Username == profile.Username).ToListAsync();
-        _db.RadCheck.RemoveRange(checks);
-
-        _db.RadCheck.Add(new RadCheck
+        // Scramble the password instead of Auth-Type := Reject so devices prompt for new credentials
+        var check = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Cleartext-Password");
+        if (check != null)
         {
-            Username = profile.Username,
-            Attribute = "Auth-Type",
-            Op = ":=",
-            Value = "Reject"
-        });
+            check.Value = "REJECT_" + Guid.NewGuid().ToString("N").Substring(0, 8);
+        }
+
+        var rejectCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type");
+        if (rejectCheck != null)
+        {
+            _db.RadCheck.Remove(rejectCheck);
+        }
 
         await _db.SaveChangesAsync();
 
@@ -331,7 +332,7 @@ public class RadiusService : IRadiusService
             });
         }
 
-        if (profile.Status == "Revoked")
+        if (profile.Status == "Revoked" || profile.Status == "Expired")
         {
             profile.Status = "Active";
             var rejectCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "Auth-Type");