first commit

OpenWarehouse.auth.api/Common/PrivilageManager/HasPrivilegeAttribute.cs

@@ -0,0 +1,66 @@
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.IdentityModel.JsonWebTokens;
+
+namespace OpenWarehouse.auth.api.Common.PrivilageManager;
+
+/// <summary>
+/// Attribute to enforce privilege-based authorization.
+/// </summary>
+public class HasPrivilegeAttribute : Attribute, IAsyncAuthorizationFilter
+{
+    private GlobalPrivilage.Privilege[] Privileges { get; }
+    
+    /// <summary>
+    /// Initializes a new instance of the <see cref="HasPrivilegeAttribute"/> class with one or more required privileges.
+    /// </summary>
+    /// <param name="privileges">The privileges required to access the resource.</param>
+    public HasPrivilegeAttribute(params GlobalPrivilage.Privilege[] privileges)
+    {
+        Privileges = privileges;
+    }
+    
+    /// <summary>
+    /// Performs the privilege check during authorization.
+    /// </summary>
+    /// <param name="context">The authorization filter context.</param>
+    public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
+    {
+        var userActionId = context.HttpContext.User.FindFirstValue(JwtRegisteredClaimNames.Sub);
+        
+        var userManager = context.HttpContext.RequestServices.GetRequiredService<UserManager<ApplicationUser>>();
+        var privilegeManager = context.HttpContext.RequestServices.GetRequiredService<PrivilegeManager>();
+
+        if (userActionId != null)
+        {
+            var userAction = await userManager.FindByIdAsync(userActionId);
+            if (userAction == null || 
+                !await UserHasAnyRequiredPrivilege(privilegeManager, userAction))
+            {
+                context.Result = new ContentResult
+                {
+                    StatusCode = StatusCodes.Status403Forbidden,
+                    Content = "Access Denied: You do not have the required privileges to perform this action.",
+                    ContentType = "text/plain"
+                };
+            }
+        }
+    }
+
+    /// <summary>
+    /// Checks if the user has at least one of the required privileges.
+    /// </summary>
+    /// <param name="privilegeManager">The privilege manager service.</param>
+    /// <param name="user">The user to check privileges for.</param>
+    /// <returns>True if the user has any required privilege; otherwise, false.</returns>
+    private async Task<bool> UserHasAnyRequiredPrivilege(PrivilegeManager privilegeManager, ApplicationUser user)
+    {
+        foreach (var privilege in Privileges)
+        {
+            if (await privilegeManager.UserHasGlobalPrivilage(user, privilege))
+            {
+                return true;
+            }
+        }
+        return false;
+    }
+}