| | | 1 | | using Elsa.Authorization; |
| | | 2 | | using Elsa.Common.Multitenancy; |
| | | 3 | | using Elsa.Extensions; |
| | | 4 | | using Elsa.Workflows.Api.RealTime.Contracts; |
| | | 5 | | using Elsa.Workflows.Management; |
| | | 6 | | using Elsa.Workflows.Management.Entities; |
| | | 7 | | using Elsa.Workflows.Management.Filters; |
| | | 8 | | using FastEndpoints.Security; |
| | | 9 | | using JetBrains.Annotations; |
| | | 10 | | using Microsoft.AspNetCore.Authorization; |
| | | 11 | | using Microsoft.AspNetCore.SignalR; |
| | | 12 | | |
| | | 13 | | namespace Elsa.Workflows.Api.RealTime.Hubs; |
| | | 14 | | |
| | | 15 | | /// <summary> |
| | | 16 | | /// Represents a SignalR hub for receiving workflow events on the client. |
| | | 17 | | /// </summary> |
| | | 18 | | [PublicAPI] |
| | | 19 | | [Authorize] |
| | | 20 | | public class WorkflowInstanceHub : Hub<IWorkflowInstanceClient> |
| | | 21 | | { |
| | 1 | 22 | | private static readonly Permission ReadInstances = new(Elsa.Workflows.Api.Permissions.WorkflowPermissions.Instances, |
| | | 23 | | private readonly IWorkflowInstanceStore _workflowInstanceStore; |
| | | 24 | | private readonly ITenantAccessor? _tenantAccessor; |
| | | 25 | | |
| | | 26 | | /// <inheritdoc /> |
| | 11 | 27 | | public WorkflowInstanceHub(IWorkflowInstanceStore workflowInstanceStore, ITenantAccessor? tenantAccessor = null) |
| | | 28 | | { |
| | 11 | 29 | | _workflowInstanceStore = workflowInstanceStore; |
| | 11 | 30 | | _tenantAccessor = tenantAccessor; |
| | 11 | 31 | | } |
| | | 32 | | |
| | | 33 | | /// <summary> |
| | | 34 | | /// Observes a workflow instance. |
| | | 35 | | /// </summary> |
| | | 36 | | /// <param name="instanceId">The ID of the workflow instance to observe.</param> |
| | | 37 | | public async Task ObserveInstanceAsync(string instanceId) |
| | | 38 | | { |
| | 10 | 39 | | if (!CanReadWorkflowInstances()) |
| | 1 | 40 | | throw new HubException("Access denied."); |
| | | 41 | | |
| | 9 | 42 | | var workflowInstance = await _workflowInstanceStore.FindAsync(new WorkflowInstanceFilter { Id = instanceId }, Co |
| | | 43 | | |
| | 9 | 44 | | if (!CanAccessTenant(workflowInstance, _tenantAccessor)) |
| | 2 | 45 | | throw new HubException("Access denied."); |
| | | 46 | | |
| | | 47 | | // Join the user to the workflow instance group. |
| | 7 | 48 | | await Groups.AddToGroupAsync(Context.ConnectionId, instanceId, Context.ConnectionAborted); |
| | 7 | 49 | | } |
| | | 50 | | |
| | | 51 | | private bool CanReadWorkflowInstances() |
| | | 52 | | { |
| | 10 | 53 | | var user = Context.User; |
| | | 54 | | |
| | 10 | 55 | | if (user?.Identity?.IsAuthenticated != true) |
| | 0 | 56 | | return false; |
| | | 57 | | |
| | 10 | 58 | | return PermissionEvaluator.Shared.HasPermission(user, ReadInstances); |
| | | 59 | | } |
| | | 60 | | |
| | | 61 | | private static bool CanAccessTenant(WorkflowInstance? workflowInstance, ITenantAccessor? tenantAccessor) |
| | | 62 | | { |
| | 9 | 63 | | if (workflowInstance == null) |
| | 1 | 64 | | return false; |
| | | 65 | | |
| | 8 | 66 | | if (tenantAccessor == null) |
| | 1 | 67 | | return true; |
| | | 68 | | |
| | 7 | 69 | | var workflowInstanceTenantId = workflowInstance.TenantId.NormalizeTenantId(); |
| | 7 | 70 | | var currentTenantId = tenantAccessor.TenantId.NormalizeTenantId(); |
| | | 71 | | |
| | 7 | 72 | | return workflowInstanceTenantId == Tenant.AgnosticTenantId || workflowInstanceTenantId == currentTenantId; |
| | | 73 | | } |
| | | 74 | | } |