gehgassi_backend/gehGassi.Web/Auth/AuthorizationHandlers/CustomerHandler.cs

using System;
using System.Threading.Tasks;
using gehGassi.Core.Interfaces;
using gehGassi.Web.Auth.Requirements;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;

namespace gehGassi.Web.Auth.AuthorizationHandlers
{
    public class CustomerHandler : AuthorizationHandler<CustomerRequirement>
    {
        readonly IHttpContextAccessor _httpContextAccessor = null;
        private readonly IUserService _userService;
        private readonly ICustomerService _customerService;
        private readonly IServiceProvider _serviceProvider;

        public CustomerHandler(IHttpContextAccessor httpContextAccessor, IUserService userService, ICustomerService customerService,
            IServiceProvider serviceProvider)
        {
            _httpContextAccessor = httpContextAccessor;
            _userService = userService;
            _customerService = customerService;
            _serviceProvider = serviceProvider;
        }

        protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, CustomerRequirement requirement)
        {
            var selectedCustomerId = context.User.CustomerId();
            var selectedCustomerUniqueId = context.User.CustomerUniqueId();
            var authorizationService = _serviceProvider.GetService(typeof(IAuthorizationService)) as IAuthorizationService;

            if (_httpContextAccessor.HttpContext != null)
            {
                if (requirement.AllowAdmin)
                {
                    if (_httpContextAccessor.HttpContext.User.Identity != null && _httpContextAccessor.HttpContext.User.Identity.IsAuthenticated)
                    {
                        if ((await authorizationService.AuthorizeAsync(_httpContextAccessor.HttpContext.User, Policies.AdministratorOnly)).Succeeded)
                        {
                            context.Succeed(requirement);
                            return;
                        }
                    }
                }

                var customerId = string.Empty;
                var routeValues = _httpContextAccessor.HttpContext.Request.RouteValues;
                if (routeValues.TryGetValue(requirement.ParameterName, out var parameter))
                {
                    if (parameter != null) customerId = parameter.ToString();
                }

                if (string.IsNullOrWhiteSpace(customerId))
                {
                    var queryString = _httpContextAccessor.HttpContext.Request.Query;
                    var queryParam = queryString[requirement.ParameterName].ToString();
                    if (!string.IsNullOrWhiteSpace(queryParam))
                        customerId = queryParam;
                }

                if (string.IsNullOrWhiteSpace(customerId))
                {
                    if (_httpContextAccessor.HttpContext.Request.HasFormContentType)
                    {
                        var formValues = _httpContextAccessor.HttpContext.Request.Form;
                        var formParam = formValues[requirement.ParameterName].ToString();
                        if (!string.IsNullOrWhiteSpace(formParam))
                            customerId = formParam;
                    }
                }

                if (selectedCustomerId != null && !string.IsNullOrWhiteSpace(customerId))
                {
                    if (string.Equals(customerId, selectedCustomerId.Value.ToString(), StringComparison.InvariantCultureIgnoreCase))
                    {
                        context.Succeed(requirement);
                        return;
                    }
                }

                if (selectedCustomerUniqueId != null && !string.IsNullOrWhiteSpace(customerId))
                {
                    if (string.Equals(customerId, selectedCustomerUniqueId.Value.ToString(), StringComparison.InvariantCultureIgnoreCase))
                    {
                        context.Succeed(requirement);
                        return;
                    }
                }

                //claim nicht gefunden. Nun je nachdem wer der Benutzer ist gegen die Datenbank prüfen....
                if (!string.IsNullOrWhiteSpace(customerId))
                {
                    var user = await _userService.GetByUsernameAsync(context.User.Identity.Name);

                    if ((await authorizationService.AuthorizeAsync(_httpContextAccessor.HttpContext.User, Policies.CustomerOnly)).Succeeded)
                    {
                        if (user.CustomerId.HasValue)
                        {
                            if (user.CustomerId.ToString() == customerId)
                            {
                                context.Succeed(requirement);
                                return;
                            }

                            if (selectedCustomerUniqueId.HasValue)
                            {
                                var customer = await _customerService.GetAsync(user.CustomerId.Value);
                                if (customer.UniqueId != null && customer.UniqueId == selectedCustomerUniqueId)
                                {
                                    context.Succeed(requirement);
                                    return;
                                }
                            }
                        }
                    }
                }
            }
            context.Fail();
        }
    }
}