julian
45 lines
2.3 KiB
C#
45 lines
2.3 KiB
C#
using System.Security.Claims;
|
|
using adas_core.Domain.Enums;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.AspNetCore.Mvc.Filters;
|
|
|
|
namespace adas_core.Authentication.Attributes;
|
|
|
|
/// <summary>
|
|
/// Specifies an authorization filter attribute that restricts access to decorated methods based on a required role of type <see cref="PermissionEnum.RolesType"/>.
|
|
/// Inherits from <see cref="Attribute"/> and implements <see cref="IAuthorizationFilter"/> to participate in the authorization pipeline.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Constrained by <see cref="System.AttributeUsageAttribute"/> to <see cref="AttributeTargets.Method"/>, the attribute is configured at construction with the required <paramref name="type"/>.
|
|
/// </remarks>
|
|
/// <!-- aidoc:v1 sig=b5093e9 -->
|
|
/// <!-- aidoc-review:v1 severity=medium kind=missing_param
|
|
/// "The primary constructor parameter 'type' is referenced via <paramref> in remarks but lacks a formal <param> tag describing its purpose." -->
|
|
[AttributeUsage(AttributeTargets.Method)]
|
|
public class AuthorizeRolesAttribute(PermissionEnum.RolesType type) : Attribute, IAuthorizationFilter
|
|
{
|
|
/// <summary>
|
|
/// Performs authorization by ensuring the current user is authenticated and has a role matching the required permission type.
|
|
/// Responds with an unauthorized result when no user is authenticated, bypasses role checking for the AuthSome permission type,
|
|
/// and otherwise responds with a forbid result when no user role starts with the permission type value.
|
|
/// </summary>
|
|
/// <param name="context">The authorization filter context providing access to the HTTP context and where the authorization result is assigned.</param>
|
|
/// <!-- aidoc:v1 sig=6368c5d body=ab6a306 -->
|
|
public void OnAuthorization(AuthorizationFilterContext context)
|
|
{
|
|
var user = context.HttpContext.User;
|
|
|
|
if (user.Identity?.IsAuthenticated != true)
|
|
{
|
|
context.Result = new UnauthorizedResult();
|
|
return;
|
|
}
|
|
|
|
var roles = user.Claims.Where(c => c.Type == ClaimTypes.Role);
|
|
|
|
if (type == PermissionEnum.RolesType.AuthSome) return;
|
|
|
|
var hasRequiredRole = roles.Any(r => r.Value.StartsWith(type.ToString()));
|
|
if (!hasRequiredRole) context.Result = new ForbidResult();
|
|
}
|
|
} |