| | | 1 | | using System.Security.Claims; |
| | | 2 | | |
| | | 3 | | namespace Elsa.Authorization; |
| | | 4 | | |
| | | 5 | | /// <inheritdoc /> |
| | | 6 | | public sealed class PermissionEvaluator : IPermissionEvaluator |
| | | 7 | | { |
| | | 8 | | /// <summary> |
| | | 9 | | /// A shared instance for call sites that cannot reach dependency injection, such as SignalR hub |
| | | 10 | | /// helpers. The evaluator holds no state, so sharing one is safe. |
| | | 11 | | /// </summary> |
| | 0 | 12 | | public static IPermissionEvaluator Shared { get; } = new PermissionEvaluator(); |
| | | 13 | | |
| | | 14 | | /// <inheritdoc /> |
| | | 15 | | public bool HasPermission(ClaimsPrincipal? principal, Permission required) |
| | | 16 | | { |
| | 85 | 17 | | return principal is not null && EnumerateGrants(principal).Any(granted => PermissionMatcher.Satisfies(granted, r |
| | | 18 | | } |
| | | 19 | | |
| | | 20 | | /// <inheritdoc /> |
| | 11 | 21 | | public bool HasPermission(ClaimsPrincipal? principal, string resource, string verb) => HasPermission(principal, new( |
| | | 22 | | |
| | | 23 | | /// <inheritdoc /> |
| | | 24 | | public bool HasAllPermissions(ClaimsPrincipal? principal, IEnumerable<Permission> required) |
| | | 25 | | { |
| | 3 | 26 | | var grants = GetGrants(principal); |
| | 8 | 27 | | return required.All(x => PermissionMatcher.Satisfies(grants, x)); |
| | | 28 | | } |
| | | 29 | | |
| | | 30 | | /// <inheritdoc /> |
| | | 31 | | public IReadOnlyCollection<Permission> GetGrants(ClaimsPrincipal? principal) |
| | | 32 | | { |
| | 6 | 33 | | return principal is null ? [] : EnumerateGrants(principal).Distinct().ToArray(); |
| | | 34 | | } |
| | | 35 | | |
| | | 36 | | /// <remarks> |
| | | 37 | | /// Reads Elsa's own permission claim type. Elsa is the only authority that expands roles into |
| | | 38 | | /// permission claims (ADR 0009), and this model no longer uses the FastEndpoints permission mechanism, |
| | | 39 | | /// so its separately configurable claim type is not consulted. |
| | | 40 | | /// </remarks> |
| | | 41 | | private static IEnumerable<Permission> EnumerateGrants(ClaimsPrincipal principal) |
| | | 42 | | { |
| | 164 | 43 | | foreach (var claim in principal.FindAll(PermissionNames.ClaimType)) |
| | | 44 | | { |
| | 55 | 45 | | if (Permission.TryParse(claim.Value, out var permission)) |
| | 52 | 46 | | yield return permission; |
| | | 47 | | } |
| | 9 | 48 | | } |
| | | 49 | | } |