gehgassi_backend/gehGassi.Web/Auth/AuthorizationHandlers/PermissionHandler.cs

using System.Linq;
using System.Threading.Tasks;
using gehGassi.Core.Interfaces;
using gehGassi.Permissions;
using gehGassi.Web.Auth.Requirements;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;

namespace gehGassi.Web.Auth.AuthorizationHandlers
{
    /// <summary>
    /// Handler für Permission Policies
    /// </summary>
    public class PermissionHandler : AuthorizationHandler<PermissionRequirement>
    {
        IHttpContextAccessor _httpContextAccessor = null;
        private readonly IUserService _userService;

        public PermissionHandler(IHttpContextAccessor httpContextAccessor, IUserService userService)
        {
            _httpContextAccessor = httpContextAccessor;
            _userService = userService;
        }

        /// <summary>
        /// Makes a decision if authorization is allowed based on a specific requirement.
        /// </summary>
        /// <param name="context">The authorization context.</param>
        /// <param name="requirement">The requirement to evaluate.</param>
        protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement)
        {
            var permissionsClaim = context.User.Claims.SingleOrDefault(c => c.Type == ClaimConstants.PackedPermissionClaimType);

            if (permissionsClaim != null)
            {
                if (permissionsClaim.Value.ThisPermissionIsAllowed(requirement.PermissionName))
                {
                    context.Succeed(requirement);
                }
                return;
            }

            //Wenn der Claim nicht vorhanden war, dann in der DB prüfen
            var user = await _userService.GetByUsernameAsync(context.User.Identity.Name);
            if (user != null)
            {
                if (string.IsNullOrWhiteSpace(user.Permissions))
                    return;

                if (user.Permissions.ThisPermissionIsAllowed(requirement.PermissionName))
                    context.Succeed(requirement);
            }
        }
    }
}