| | | 1 | | using System.Security.Claims; |
| | | 2 | | using Elsa.Authorization; |
| | | 3 | | using Elsa.ExternalAuthentication.Contracts; |
| | | 4 | | using Elsa.ExternalAuthentication.Models; |
| | | 5 | | using Elsa.ExternalAuthentication.Options; |
| | | 6 | | using Elsa.ExternalAuthentication.Permissions; |
| | | 7 | | using Microsoft.Extensions.Options; |
| | | 8 | | |
| | | 9 | | namespace Elsa.ExternalAuthentication.Services; |
| | | 10 | | |
| | | 11 | | /// <summary>Prevents a management edit from removing the final ordinary sign-in path by accident.</summary> |
| | 12 | 12 | | public sealed class FinalLoginPathGuard(IIdentityProviderConnectionRegistry registry, IOptions<ExternalAuthenticationOpt |
| | | 13 | | { |
| | | 14 | | public async ValueTask<FinalLoginPathGuardResult> AuthorizeAsync(IdentityProviderConnection existing, IdentityProvid |
| | | 15 | | { |
| | 20 | 16 | | var guard = options.Value.FinalLoginPathGuard; |
| | 20 | 17 | | if (!guard.IsEnabled || !guard.RequireRecoveryMethod || !IsNormal(existing) || IsNormal(candidate) || guard.HasB |
| | 17 | 18 | | return FinalLoginPathGuardResult.Allowed; |
| | 3 | 19 | | var effective = await registry.GetAsync(targetTenantId, cancellationToken); |
| | 5 | 20 | | if (effective.Connections.Any(x => !string.Equals(x.Connection.Id, existing.Id, StringComparison.Ordinal) && IsN |
| | 0 | 21 | | return FinalLoginPathGuardResult.Allowed; |
| | 3 | 22 | | var canOverride = confirmedOverride && permissionEvaluator.HasPermission(actor, guard.PrivilegedOverridePermissi |
| | 3 | 23 | | return canOverride ? FinalLoginPathGuardResult.Allowed : FinalLoginPathGuardResult.Denied; |
| | 20 | 24 | | } |
| | | 25 | | |
| | 9 | 26 | | private static bool IsNormal(IdentityProviderConnection connection) => connection is { IsEnabled: true, ArchivedAt: |
| | | 27 | | } |
| | | 28 | | |
| | | 29 | | public enum FinalLoginPathGuardResult { Allowed, Denied } |