| | | 1 | | using Elsa.Authorization; |
| | | 2 | | using Elsa.Abstractions; |
| | | 3 | | using Elsa.Identity.Contracts; |
| | | 4 | | using Elsa.Identity.Models; |
| | | 5 | | using Elsa.Permissions; |
| | | 6 | | using JetBrains.Annotations; |
| | | 7 | | using Microsoft.AspNetCore.Http; |
| | | 8 | | |
| | | 9 | | namespace Elsa.Identity.Endpoints.Roles.Create; |
| | | 10 | | |
| | | 11 | | /// <summary> |
| | | 12 | | /// An endpoint that creates a new role. |
| | | 13 | | /// </summary> |
| | | 14 | | [PublicAPI] |
| | 3 | 15 | | internal class Create(IRoleManager roleManager, IRoleAuthorizationService roleAuthorizationService, IPermissionGrantVali |
| | | 16 | | { |
| | | 17 | | /// <inheritdoc /> |
| | | 18 | | public override void Configure() |
| | | 19 | | { |
| | 5 | 20 | | Post("/identity/roles"); |
| | 5 | 21 | | RequirePermission(Elsa.Identity.Permissions.IdentityPermissions.Roles, CoreVerbs.Create); |
| | 5 | 22 | | } |
| | | 23 | | |
| | | 24 | | /// <inheritdoc /> |
| | | 25 | | public override async Task HandleAsync(Request request, CancellationToken cancellationToken) |
| | | 26 | | { |
| | | 27 | | // Reject grants the catalog cannot account for before the anti-escalation check, so an author gets |
| | | 28 | | // a specific message rather than a blanket 403 for what is really a typo. |
| | 0 | 29 | | var validation = grantValidator.Validate(request.Permissions); |
| | | 30 | | |
| | 0 | 31 | | if (!validation.IsValid) |
| | | 32 | | { |
| | | 33 | | // Both parts matter: the permission identifies which entry to fix, the reason says how. |
| | 0 | 34 | | foreach (var error in validation.Errors) |
| | 0 | 35 | | AddError($"{error.Permission} — {error.Reason}"); |
| | | 36 | | |
| | 0 | 37 | | await Send.ErrorsAsync(cancellation: cancellationToken); |
| | 0 | 38 | | return; |
| | | 39 | | } |
| | | 40 | | |
| | 0 | 41 | | if (!roleAuthorizationService.CanCreateRoleWithPermissions(User, request.Permissions)) |
| | | 42 | | { |
| | 0 | 43 | | await Send.ForbiddenAsync(cancellationToken); |
| | 0 | 44 | | return; |
| | | 45 | | } |
| | | 46 | | |
| | | 47 | | CreateRoleResult result; |
| | | 48 | | try |
| | | 49 | | { |
| | 0 | 50 | | result = await roleManager.CreateRoleAsync( |
| | 0 | 51 | | request.Name, |
| | 0 | 52 | | request.Permissions, |
| | 0 | 53 | | request.Id, |
| | 0 | 54 | | cancellationToken); |
| | 0 | 55 | | } |
| | 0 | 56 | | catch (InvalidOperationException ex) when (ex.Message.Contains("already exists", StringComparison.OrdinalIgnoreC |
| | | 57 | | { |
| | 0 | 58 | | await Send.ErrorsAsync(StatusCodes.Status409Conflict, cancellationToken); |
| | 0 | 59 | | return; |
| | | 60 | | } |
| | | 61 | | |
| | 0 | 62 | | await securityNotifier.RoleChangedAsync(User, "created", result.Role.Id, result.Role.Name, result.Role.Permissio |
| | | 63 | | |
| | 0 | 64 | | var response = new Response( |
| | 0 | 65 | | result.Role.Id, |
| | 0 | 66 | | result.Role.Name, |
| | 0 | 67 | | result.Role.Permissions); |
| | | 68 | | |
| | 0 | 69 | | await Send.OkAsync(response, cancellationToken); |
| | 0 | 70 | | } |
| | | 71 | | } |