| | | 1 | | using System.Security.Claims; |
| | | 2 | | using Elsa.Authorization; |
| | | 3 | | |
| | | 4 | | namespace Elsa.ExternalAuthentication.Permissions; |
| | | 5 | | |
| | | 6 | | /// <summary> |
| | | 7 | | /// Evaluates permissions the module carries as configured or delegated <em>strings</em> rather than as a |
| | | 8 | | /// resource and verb pair. |
| | | 9 | | /// </summary> |
| | | 10 | | /// <remarks> |
| | | 11 | | /// These are the call sites that used to compare claim values with ordinal equality, which made a wildcard |
| | | 12 | | /// grant mean one thing on an endpoint and another here. Routing them through <see cref="IPermissionEvaluator"/> |
| | | 13 | | /// leaves one matching rule for the whole module. |
| | | 14 | | /// </remarks> |
| | | 15 | | internal static class PermissionEvaluatorExtensions |
| | | 16 | | { |
| | | 17 | | /// <summary> |
| | | 18 | | /// Whether <paramref name="actor"/> holds a permission satisfying <paramref name="permission"/>. A value |
| | | 19 | | /// that is not a well-formed permission is held by nobody, so a malformed setting fails closed. |
| | | 20 | | /// </summary> |
| | | 21 | | public static bool HasPermission(this IPermissionEvaluator evaluator, ClaimsPrincipal? actor, string permission) => |
| | 8 | 22 | | Permission.TryParse(permission, out var required) && evaluator.HasPermission(actor, required); |
| | | 23 | | } |