gehgassi_backend/gehGassi.Web/Auth/AuthorizationHandlers/ApplicationUserHandler.cs

using System;
using System.Threading.Tasks;
using gehGassi.Core.Interfaces;
using gehGassi.Web.Auth.Requirements;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;

namespace gehGassi.Web.Auth.AuthorizationHandlers
{
    public class ApplicationUserHandler : AuthorizationHandler<AppUserRequirement>
    {
        readonly IHttpContextAccessor _httpContextAccessor = null;
        private readonly IUserService _userService;
        private readonly IAppUserService _appUserService;
        private readonly IServiceProvider _serviceProvider;

        public ApplicationUserHandler(IHttpContextAccessor httpContextAccessor, IUserService userService, IAppUserService appUserService, IServiceProvider serviceProvider)
        {
            _httpContextAccessor = httpContextAccessor;
            _userService = userService;
            _appUserService = appUserService;
            _serviceProvider = serviceProvider;
        }

        protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, AppUserRequirement requirement)
        {
            var selectedApplicationUserId = context.User.AppUserId();
            var authorizationService = _serviceProvider.GetService(typeof(IAuthorizationService)) as IAuthorizationService;

            if (_httpContextAccessor.HttpContext != null)
            {
                if (requirement.AllowAdmin)
                {
                    if (_httpContextAccessor.HttpContext.User.Identity != null && _httpContextAccessor.HttpContext.User.Identity.IsAuthenticated)
                    {
                        if ((await authorizationService.AuthorizeAsync(_httpContextAccessor.HttpContext.User, Policies.AdministratorOnly)).Succeeded)
                        {
                            context.Succeed(requirement);
                            return;
                        }
                    }
                }

                var applicationUserId = string.Empty;
                var routeValues = _httpContextAccessor.HttpContext.Request.RouteValues;
                if (routeValues.TryGetValue(requirement.ParameterName, out var parameter))
                {
                    if (parameter != null) applicationUserId = parameter.ToString();
                }

                if (string.IsNullOrWhiteSpace(applicationUserId))
                {
                    var queryString = _httpContextAccessor.HttpContext.Request.Query;
                    var queryParam = queryString[requirement.ParameterName].ToString();
                    if (!string.IsNullOrWhiteSpace(queryParam))
                        applicationUserId = queryParam;
                }

                if (string.IsNullOrWhiteSpace(applicationUserId))
                {
                    if (_httpContextAccessor.HttpContext.Request.HasFormContentType)
                    {
                        var formValues = _httpContextAccessor.HttpContext.Request.Form;
                        var formParam = formValues[requirement.ParameterName].ToString();
                        if (!string.IsNullOrWhiteSpace(formParam))
                            applicationUserId = formParam;
                    }
                }

                if (selectedApplicationUserId != null && !string.IsNullOrWhiteSpace(applicationUserId))
                {
                    if (string.Equals(applicationUserId, selectedApplicationUserId, StringComparison.InvariantCultureIgnoreCase))
                    {
                        context.Succeed(requirement);
                        return;
                    }
                }

                //claim nicht gefunden. Nun je nachdem wer der Benutzer ist gegen die Datenbank prüfen....
                if (!string.IsNullOrWhiteSpace(applicationUserId))
                {
                    var user = await _userService.GetByUsernameAsync(context.User.Identity.Name);

                    if ((await authorizationService.AuthorizeAsync(_httpContextAccessor.HttpContext.User, Policies.AppUserOnly)).Succeeded)
                    {
                        if (!string.IsNullOrWhiteSpace(user.AppUserId))
                        {
                            if (user.AppUserId == applicationUserId)
                            {
                                context.Succeed(requirement);
                                return;
                            }
                        }
                    }
                }
            }
            context.Fail();
        }
    }
}