| | | 1 | | using System.Security.Claims; |
| | | 2 | | using Elsa.Authorization; |
| | | 3 | | using Elsa.Extensions; |
| | | 4 | | using Elsa.Identity.Contracts; |
| | | 5 | | using Elsa.Identity.Entities; |
| | | 6 | | |
| | | 7 | | namespace Elsa.Identity.Services; |
| | | 8 | | |
| | | 9 | | /// <inheritdoc /> |
| | 26 | 10 | | public class RoleAuthorizationService(IRoleProvider roleProvider, IPermissionEvaluator evaluator) : IRoleAuthorizationSe |
| | | 11 | | { |
| | | 12 | | /// <inheritdoc /> |
| | | 13 | | public async Task<bool> CanAssignRolesAsync(ClaimsPrincipal user, IEnumerable<string>? roleIds, CancellationToken ca |
| | | 14 | | { |
| | | 15 | | var requestedRoleIds = roleIds?.Where(x => !string.IsNullOrWhiteSpace(x)).Distinct().ToList(); |
| | 3 | 16 | | if (requestedRoleIds == null || requestedRoleIds.Count == 0) |
| | 0 | 17 | | return true; |
| | | 18 | | |
| | 3 | 19 | | var requestedRoleIdSet = requestedRoleIds.ToHashSet(StringComparer.Ordinal); |
| | 3 | 20 | | var roles = (await roleProvider.FindByIdsAsync(requestedRoleIds, cancellationToken)) |
| | 2 | 21 | | .Where(x => requestedRoleIdSet.Contains(x.Id)) |
| | 3 | 22 | | .ToList(); |
| | | 23 | | var resolvedRoleIdSet = roles.Select(x => x.Id).ToHashSet(StringComparer.Ordinal); |
| | 3 | 24 | | if (!resolvedRoleIdSet.SetEquals(requestedRoleIdSet)) |
| | 1 | 25 | | return false; |
| | | 26 | | |
| | | 27 | | var permissions = roles.SelectMany(x => x.Permissions); |
| | 2 | 28 | | return HasAllPermissions(user, permissions); |
| | 3 | 29 | | } |
| | | 30 | | |
| | | 31 | | /// <inheritdoc /> |
| | 0 | 32 | | public bool CanCreateRoleWithPermissions(ClaimsPrincipal user, IEnumerable<string>? permissions) => HasAllPermission |
| | | 33 | | |
| | | 34 | | /// <inheritdoc /> |
| | | 35 | | public bool CanMutateRole(ClaimsPrincipal user, Role role, IEnumerable<string>? replacementPermissions = null) |
| | | 36 | | { |
| | 31 | 37 | | var permissions = replacementPermissions == null |
| | 31 | 38 | | ? role.Permissions |
| | 31 | 39 | | : role.Permissions.Concat(replacementPermissions); |
| | | 40 | | |
| | 31 | 41 | | return HasAllPermissions(user, permissions); |
| | | 42 | | } |
| | | 43 | | |
| | | 44 | | /// <remarks> |
| | | 45 | | /// Containment is evaluated through <see cref="IPermissionEvaluator"/> rather than by set membership, |
| | | 46 | | /// so a caller holding <c>workflows/*:view</c> may grant <c>workflows/definitions:view</c>, while a |
| | | 47 | | /// caller holding only the concrete grant may not grant the broader wildcard. Set membership would get |
| | | 48 | | /// the first case wrong and force administrators to hold every concrete grant they wish to delegate. |
| | | 49 | | /// </remarks> |
| | | 50 | | private bool HasAllPermissions(ClaimsPrincipal user, IEnumerable<string>? permissions) |
| | | 51 | | { |
| | 33 | 52 | | if (permissions is null) |
| | 0 | 53 | | return true; |
| | | 54 | | |
| | 33 | 55 | | var required = permissions |
| | 4 | 56 | | .Where(x => !string.IsNullOrWhiteSpace(x)) |
| | 33 | 57 | | .Distinct(StringComparer.Ordinal) |
| | 4 | 58 | | .Select(x => Permission.TryParse(x, out var permission) ? permission : (Permission?)null) |
| | 33 | 59 | | .ToArray(); |
| | | 60 | | |
| | | 61 | | // A permission that does not parse cannot be reasoned about, so it is never delegable. |
| | 37 | 62 | | if (required.Any(x => x is null)) |
| | 0 | 63 | | return false; |
| | | 64 | | |
| | 36 | 65 | | return evaluator.HasAllPermissions(user, required.Select(x => x!.Value)); |
| | | 66 | | } |
| | | 67 | | } |