67 lines
2.6 KiB
C#
67 lines
2.6 KiB
C#
using Microsoft.AspNetCore.Mvc.Filters;
|
|
using Microsoft.IdentityModel.JsonWebTokens;
|
|
|
|
namespace OpenWarehouse.auth.api.Common.PrivilageManager;
|
|
|
|
/// <summary>
|
|
/// Attribute to enforce privilege-based authorization.
|
|
/// </summary>
|
|
public class HasPrivilegeAttribute : Attribute, IAsyncAuthorizationFilter
|
|
{
|
|
private GlobalPrivilage.Privilege[] Privileges { get; }
|
|
|
|
/// <summary>
|
|
/// Initializes a new instance of the <see cref="HasPrivilegeAttribute"/> class with one or more required privileges.
|
|
/// </summary>
|
|
/// <param name="privileges">The privileges required to access the resource.</param>
|
|
public HasPrivilegeAttribute(params GlobalPrivilage.Privilege[] privileges)
|
|
{
|
|
Privileges = privileges;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Performs the privilege check during authorization.
|
|
/// </summary>
|
|
/// <param name="context">The authorization filter context.</param>
|
|
public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
|
|
{
|
|
var userActionId = context.HttpContext.User.FindFirstValue(JwtRegisteredClaimNames.Sub);
|
|
|
|
var userManager = context.HttpContext.RequestServices.GetRequiredService<UserManager<ApplicationUser>>();
|
|
var privilegeManager = context.HttpContext.RequestServices.GetRequiredService<PrivilegeManager>();
|
|
|
|
if (userActionId != null)
|
|
{
|
|
var userAction = await userManager.FindByIdAsync(userActionId);
|
|
if (userAction == null ||
|
|
!await UserHasAnyRequiredPrivilege(privilegeManager, userAction))
|
|
{
|
|
context.Result = new ContentResult
|
|
{
|
|
StatusCode = StatusCodes.Status403Forbidden,
|
|
Content = "Access Denied: You do not have the required privileges to perform this action.",
|
|
ContentType = "text/plain"
|
|
};
|
|
}
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// Checks if the user has at least one of the required privileges.
|
|
/// </summary>
|
|
/// <param name="privilegeManager">The privilege manager service.</param>
|
|
/// <param name="user">The user to check privileges for.</param>
|
|
/// <returns>True if the user has any required privilege; otherwise, false.</returns>
|
|
private async Task<bool> UserHasAnyRequiredPrivilege(PrivilegeManager privilegeManager, ApplicationUser user)
|
|
{
|
|
foreach (var privilege in Privileges)
|
|
{
|
|
if (await privilegeManager.UserHasGlobalPrivilage(user, privilege))
|
|
{
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
}
|