101 lines
4.4 KiB
C#
101 lines
4.4 KiB
C#
using System;
|
|
using System.Threading.Tasks;
|
|
using gehGassi.Core.Interfaces;
|
|
using gehGassi.Web.Auth.Requirements;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Http;
|
|
|
|
namespace gehGassi.Web.Auth.AuthorizationHandlers
|
|
{
|
|
public class ApplicationUserHandler : AuthorizationHandler<AppUserRequirement>
|
|
{
|
|
readonly IHttpContextAccessor _httpContextAccessor = null;
|
|
private readonly IUserService _userService;
|
|
private readonly IAppUserService _appUserService;
|
|
private readonly IServiceProvider _serviceProvider;
|
|
|
|
public ApplicationUserHandler(IHttpContextAccessor httpContextAccessor, IUserService userService, IAppUserService appUserService, IServiceProvider serviceProvider)
|
|
{
|
|
_httpContextAccessor = httpContextAccessor;
|
|
_userService = userService;
|
|
_appUserService = appUserService;
|
|
_serviceProvider = serviceProvider;
|
|
}
|
|
|
|
protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, AppUserRequirement requirement)
|
|
{
|
|
var selectedApplicationUserId = context.User.AppUserId();
|
|
var authorizationService = _serviceProvider.GetService(typeof(IAuthorizationService)) as IAuthorizationService;
|
|
|
|
if (_httpContextAccessor.HttpContext != null)
|
|
{
|
|
if (requirement.AllowAdmin)
|
|
{
|
|
if (_httpContextAccessor.HttpContext.User.Identity != null && _httpContextAccessor.HttpContext.User.Identity.IsAuthenticated)
|
|
{
|
|
if ((await authorizationService.AuthorizeAsync(_httpContextAccessor.HttpContext.User, Policies.AdministratorOnly)).Succeeded)
|
|
{
|
|
context.Succeed(requirement);
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
|
|
var applicationUserId = string.Empty;
|
|
var routeValues = _httpContextAccessor.HttpContext.Request.RouteValues;
|
|
if (routeValues.TryGetValue(requirement.ParameterName, out var parameter))
|
|
{
|
|
if (parameter != null) applicationUserId = parameter.ToString();
|
|
}
|
|
|
|
if (string.IsNullOrWhiteSpace(applicationUserId))
|
|
{
|
|
var queryString = _httpContextAccessor.HttpContext.Request.Query;
|
|
var queryParam = queryString[requirement.ParameterName].ToString();
|
|
if (!string.IsNullOrWhiteSpace(queryParam))
|
|
applicationUserId = queryParam;
|
|
}
|
|
|
|
if (string.IsNullOrWhiteSpace(applicationUserId))
|
|
{
|
|
if (_httpContextAccessor.HttpContext.Request.HasFormContentType)
|
|
{
|
|
var formValues = _httpContextAccessor.HttpContext.Request.Form;
|
|
var formParam = formValues[requirement.ParameterName].ToString();
|
|
if (!string.IsNullOrWhiteSpace(formParam))
|
|
applicationUserId = formParam;
|
|
}
|
|
}
|
|
|
|
if (selectedApplicationUserId != null && !string.IsNullOrWhiteSpace(applicationUserId))
|
|
{
|
|
if (string.Equals(applicationUserId, selectedApplicationUserId, StringComparison.InvariantCultureIgnoreCase))
|
|
{
|
|
context.Succeed(requirement);
|
|
return;
|
|
}
|
|
}
|
|
|
|
//claim nicht gefunden. Nun je nachdem wer der Benutzer ist gegen die Datenbank prüfen....
|
|
if (!string.IsNullOrWhiteSpace(applicationUserId))
|
|
{
|
|
var user = await _userService.GetByUsernameAsync(context.User.Identity.Name);
|
|
|
|
if ((await authorizationService.AuthorizeAsync(_httpContextAccessor.HttpContext.User, Policies.AppUserOnly)).Succeeded)
|
|
{
|
|
if (!string.IsNullOrWhiteSpace(user.AppUserId))
|
|
{
|
|
if (user.AppUserId == applicationUserId)
|
|
{
|
|
context.Succeed(requirement);
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
context.Fail();
|
|
}
|
|
}
|
|
}
|