Creado apartir del commit b888de6c92056de294456f581a56e25e734d4ab7 de develop

adas-core.Authentication/Attributes/AuthorizeRolesAttribute.cs

@@ -0,0 +1,28 @@
+using System.Security.Claims;
+using adas_core.Domain.Enums;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace adas_core.Authentication.Attributes;
+
+[AttributeUsage(AttributeTargets.Method)]
+public class AuthorizeRolesAttribute(PermissionEnum.RolesType type) : Attribute, IAuthorizationFilter
+{
+    public void OnAuthorization(AuthorizationFilterContext context)
+    {
+        var user = context.HttpContext.User;
+
+        if (user.Identity?.IsAuthenticated != true)
+        {
+            context.Result = new UnauthorizedResult();
+            return;
+        }
+
+        var roles = user.Claims.Where(c => c.Type == ClaimTypes.Role);
+
+        if (type == PermissionEnum.RolesType.AuthSome) return;
+
+        var hasRequiredRole = roles.Any(r => r.Value.StartsWith(type.ToString()));
+        if (!hasRequiredRole) context.Result = new ForbidResult();
+    }
+}

adas-core.Authentication/Attributes/AuthorizeUserByService.cs

@@ -0,0 +1,29 @@
+using adas_core.Authentication.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace adas_core.Authentication.Attributes;
+
+public class AuthorizePermissionsAttribute(
+    IUserService userService)
+    : Attribute, IAuthorizationFilter
+{
+    public void OnAuthorization(AuthorizationFilterContext context)
+    {
+        var user = context.HttpContext.User;
+
+        var userName = user.Identity?.Name ?? string.Empty;
+        var displayIdHeader = context.HttpContext.Request.Headers["Displayid"];
+
+        if (string.IsNullOrEmpty(displayIdHeader.ToString()))
+        {
+            context.Result = new NotFoundObjectResult("displayIdHeader not found reference id doesn't exist on header");
+            return;
+        }
+
+        var userDao = userService.GetUserByUserName(userName).Result;
+
+        if (userDao == null)
+            context.Result = new NotFoundObjectResult("User not found on AuthorizePermissionsAttribute");
+    }
+}

adas-core.Authentication/Attributes/PermissionAuthorizeAttribute.cs

@@ -0,0 +1,98 @@
+using System.Security.Claims;
+using adas_core.Application.Exceptions;
+using adas_core.Application.Services.Interfaces;
+using adas_core.Domain.Enums;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace adas_core.Authentication.Attributes;
+
+public class PermissionAuthorizeAttribute(string source, string? resourceIdHeader = null)
+    : AuthorizeAttribute, IAsyncAuthorizationFilter
+{
+    public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
+    {
+        // Obtener el servicio de permisos.
+        var permissionService = context.HttpContext.RequestServices.GetService<IPermissionService>()
+                                ?? throw new ForbbidenException(HttpEnum.ErrorMessage.ForbiddenNoPermission);
+
+        var user = context.HttpContext.User;
+
+        // Obtener el header que indica la fuente.
+        var headerSource = context.HttpContext.Request.Headers[source].FirstOrDefault();
+
+        // Obtener el identificador del usuario
+        var username = user.Claims.FirstOrDefault(c => c.Type == ClaimTypes.NameIdentifier)?.Value;
+
+        // Obtiene la lista de roles (valores) del usuario.
+        var userRoles = user.Claims
+            .Where(c => c.Type == ClaimTypes.Role)
+            .Select(c => c.Value)
+            .ToList();
+
+        // Procesa cada rol: si contiene 2 guiones bajos, elimina el tercer segmento.
+        var processedRoles = userRoles.Select(role =>
+        {
+            var parts = role.Split('_');
+            return parts.Length == 2 ? parts[0] : role;
+        }).ToList();
+
+        // Validar que se tenga al menos un rol, username y headerSource.
+        if (!processedRoles.Any() || string.IsNullOrEmpty(username) || string.IsNullOrEmpty(headerSource))
+        {
+            context.Result = new ForbidResult();
+            return;
+        }
+
+        // Parseamos el header para obtener la fuente.
+        var source1 =
+            (PermissionEnum.SourcePermissionsEnum)Enum.Parse(typeof(PermissionEnum.SourcePermissionsEnum),
+                headerSource);
+
+        var hasPermission = false;
+
+        if (source1 == PermissionEnum.SourcePermissionsEnum.Panel)
+        {
+            // Si la fuente es PANEL, verificamos que alguno de los roles tenga acceso.
+            foreach (var roleStr in processedRoles)
+            {
+                if (!Enum.TryParse(typeof(PermissionEnum.RolesType), roleStr, out var roleObj)) continue;
+                var role = (PermissionEnum.RolesType)roleObj;
+                if (!await permissionService.HasAccessToPanel(username, role, source1)) continue;
+                hasPermission = true;
+                break;
+            }
+
+            if (!hasPermission) context.Result = new ForbidResult();
+        }
+        else if (resourceIdHeader != null)
+        {
+            // Para otras fuentes, se requiere un header que indique el resourceId.
+            var resourceId = context.HttpContext.Request.Headers[resourceIdHeader].FirstOrDefault();
+            if (string.IsNullOrEmpty(resourceId))
+            {
+                context.Result = new ForbidResult();
+                return;
+            }
+
+            // Verificar que al menos uno de los roles tenga acceso al recurso.
+            foreach (var roleStr in processedRoles)
+                if (Enum.TryParse(typeof(PermissionEnum.RolesType), roleStr, out var roleObj))
+                {
+                    var role = (PermissionEnum.RolesType)roleObj;
+                    hasPermission = resourceIdHeader switch
+                    {
+                        "DisplayId" => await permissionService.HasAccessToDisplay(username, role, source1, resourceId),
+                        "UnitId" => await permissionService.HasAccessToUnit(username, role, source1, resourceId),
+                        _ => false
+                    };
+                    if (hasPermission)
+                        break;
+                }
+
+            if (!hasPermission) context.Result = new ForbidResult();
+        }
+    }
+}