| | | 1 | | using System.Security.Claims; |
| | | 2 | | using Elsa.Extensions; |
| | | 3 | | using Elsa.Identity.Contracts; |
| | | 4 | | using Elsa.Identity.Entities; |
| | | 5 | | |
| | | 6 | | namespace Elsa.Identity.Services; |
| | | 7 | | |
| | | 8 | | /// <inheritdoc /> |
| | 7 | 9 | | public class RoleAuthorizationService(IRoleProvider roleProvider) : IRoleAuthorizationService |
| | | 10 | | { |
| | | 11 | | /// <inheritdoc /> |
| | | 12 | | public async Task<bool> CanAssignRolesAsync(ClaimsPrincipal user, IEnumerable<string>? roleIds, CancellationToken ca |
| | | 13 | | { |
| | 6 | 14 | | var requestedRoleIds = roleIds?.Where(x => !string.IsNullOrWhiteSpace(x)).Distinct().ToList(); |
| | 3 | 15 | | if (requestedRoleIds == null || requestedRoleIds.Count == 0) |
| | 0 | 16 | | return true; |
| | | 17 | | |
| | 3 | 18 | | var requestedRoleIdSet = requestedRoleIds.ToHashSet(StringComparer.Ordinal); |
| | 3 | 19 | | var roles = (await roleProvider.FindByIdsAsync(requestedRoleIds, cancellationToken)) |
| | 2 | 20 | | .Where(x => requestedRoleIdSet.Contains(x.Id)) |
| | 3 | 21 | | .ToList(); |
| | 5 | 22 | | var resolvedRoleIdSet = roles.Select(x => x.Id).ToHashSet(StringComparer.Ordinal); |
| | 3 | 23 | | if (!resolvedRoleIdSet.SetEquals(requestedRoleIdSet)) |
| | 1 | 24 | | return false; |
| | | 25 | | |
| | 3 | 26 | | var permissions = roles.SelectMany(x => x.Permissions); |
| | 2 | 27 | | return HasAllPermissions(user, permissions); |
| | 3 | 28 | | } |
| | | 29 | | |
| | | 30 | | /// <inheritdoc /> |
| | 0 | 31 | | public bool CanCreateRoleWithPermissions(ClaimsPrincipal user, IEnumerable<string>? permissions) => HasAllPermission |
| | | 32 | | |
| | | 33 | | /// <inheritdoc /> |
| | | 34 | | public bool CanMutateRole(ClaimsPrincipal user, Role role, IEnumerable<string>? replacementPermissions = null) |
| | | 35 | | { |
| | 1 | 36 | | var permissions = replacementPermissions == null |
| | 1 | 37 | | ? role.Permissions |
| | 1 | 38 | | : role.Permissions.Concat(replacementPermissions); |
| | | 39 | | |
| | 1 | 40 | | return HasAllPermissions(user, permissions); |
| | | 41 | | } |
| | | 42 | | |
| | | 43 | | private static bool HasAllPermissions(ClaimsPrincipal user, IEnumerable<string>? permissions) |
| | | 44 | | { |
| | 3 | 45 | | var grantedPermissions = user |
| | 3 | 46 | | .FindAll(PermissionNames.ClaimType) |
| | 3 | 47 | | .Select(x => x.Value) |
| | 3 | 48 | | .Where(x => !string.IsNullOrWhiteSpace(x)) |
| | 3 | 49 | | .ToHashSet(StringComparer.Ordinal); |
| | | 50 | | |
| | 3 | 51 | | if (grantedPermissions.Contains(PermissionNames.All)) |
| | 1 | 52 | | return true; |
| | | 53 | | |
| | 2 | 54 | | return permissions? |
| | 2 | 55 | | .Where(x => !string.IsNullOrWhiteSpace(x)) |
| | 2 | 56 | | .Distinct() |
| | 2 | 57 | | .All(grantedPermissions.Contains) ?? true; |
| | | 58 | | } |
| | | 59 | | } |