Skip to content

Commit 6744a90

Browse files
sei-tspencersei-tspencer
authored
Debug (#40)
* use db in requirements
1 parent cbd90fb commit 6744a90

17 files changed

+116
-83
lines changed

‎Cite.Api/Cite.Api.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<Project Sdk="Microsoft.NET.Sdk.Web">
22

33
<PropertyGroup>
4-
<Version>1.5.0</Version>
4+
<Version>1.5.1</Version>
55
<TargetFramework>net6.0</TargetFramework>
66
<DocumentationFile>bin\$(Configuration)\$(TargetFramework)\$(AssemblyName).xml</DocumentationFile>
77
<NoWarn>CS1591</NoWarn>

‎Cite.Api/Infrastructure/Authorization/CanIncrementIncidentRequirement.cs‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,34 @@
33

44
using Microsoft.AspNetCore.Authorization;
55
using System;
6+
using System.Linq;
67
using System.Threading.Tasks;
8+
using Cite.Api.Data;
79

810
namespace Cite.Api.Infrastructure.Authorization
911
{
1012
public class CanIncrementMoveRequirement : IAuthorizationRequirement
1113
{
1214
public readonly Guid EvaluationId;
15+
public readonly CiteContext DbContext;
1316

14-
public CanIncrementMoveRequirement(Guid evaluationId)
17+
public CanIncrementMoveRequirement(Guid evaluationId, CiteContext dbContext)
1518
{
1619
EvaluationId = evaluationId;
20+
DbContext = dbContext;
1721
}
1822
}
1923

2024
public class CanIncrementMoveHandler : AuthorizationHandler<CanIncrementMoveRequirement>, IAuthorizationHandler
2125
{
2226
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CanIncrementMoveRequirement requirement)
2327
{
24-
if (context.User.HasClaim(c =>
25-
c.Type == CiteClaimTypes.CanIncrementMove.ToString() &&
26-
c.Value.Contains(requirement.EvaluationId.ToString())
27-
))
28+
var userId = context.User.Identities.First().Claims.First(c => c.Type == "sub")?.Value;
29+
var canIncrement = requirement.DbContext.TeamUsers
30+
.Any(tu => tu.Team.EvaluationId == requirement.EvaluationId &&
31+
tu.UserId.ToString() == userId &&
32+
tu.CanIncrementMove);
33+
if (canIncrement)
2834
{
2935
context.Succeed(requirement);
3036
}

‎Cite.Api/Infrastructure/Authorization/CanModifyRequirement.cs‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,34 @@
33

44
using Microsoft.AspNetCore.Authorization;
55
using System;
6+
using System.Linq;
67
using System.Threading.Tasks;
8+
using Cite.Api.Data;
79

810
namespace Cite.Api.Infrastructure.Authorization
911
{
1012
public class CanModifyRequirement : IAuthorizationRequirement
1113
{
1214
public readonly Guid EvaluationId;
15+
public readonly CiteContext DbContext;
1316

14-
public CanModifyRequirement(Guid evaluationId)
17+
public CanModifyRequirement(Guid evaluationId, CiteContext dbContext)
1518
{
1619
EvaluationId = evaluationId;
20+
DbContext = dbContext;
1721
}
1822
}
1923

2024
public class CanModifyHandler : AuthorizationHandler<CanModifyRequirement>, IAuthorizationHandler
2125
{
2226
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CanModifyRequirement requirement)
2327
{
24-
if (context.User.HasClaim(c =>
25-
c.Type == CiteClaimTypes.CanModify.ToString() &&
26-
c.Value.Contains(requirement.EvaluationId.ToString())
27-
))
28+
var userId = context.User.Identities.First().Claims.First(c => c.Type == "sub")?.Value;
29+
var canModify = requirement.DbContext.TeamUsers
30+
.Any(tu => tu.Team.EvaluationId == requirement.EvaluationId &&
31+
tu.UserId.ToString() == userId &&
32+
tu.CanModify);
33+
if (canModify)
2834
{
2935
context.Succeed(requirement);
3036
}

‎Cite.Api/Infrastructure/Authorization/CanSubmitRequirement.cs‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,34 @@
33

44
using Microsoft.AspNetCore.Authorization;
55
using System;
6+
using System.Linq;
67
using System.Threading.Tasks;
8+
using Cite.Api.Data;
79

810
namespace Cite.Api.Infrastructure.Authorization
911
{
1012
public class CanSubmitRequirement : IAuthorizationRequirement
1113
{
1214
public readonly Guid EvaluationId;
15+
public readonly CiteContext DbContext;
1316

14-
public CanSubmitRequirement(Guid evaluationId)
17+
public CanSubmitRequirement(Guid evaluationId, CiteContext dbContext)
1518
{
1619
EvaluationId = evaluationId;
20+
DbContext = dbContext;
1721
}
1822
}
1923

2024
public class CanSubmitHandler : AuthorizationHandler<CanSubmitRequirement>, IAuthorizationHandler
2125
{
2226
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CanSubmitRequirement requirement)
2327
{
24-
if (context.User.HasClaim(c =>
25-
c.Type == CiteClaimTypes.CanSubmit.ToString() &&
26-
c.Value.Contains(requirement.EvaluationId.ToString())
27-
))
28+
var userId = context.User.Identities.First().Claims.First(c => c.Type == "sub")?.Value;
29+
var canSubmit = requirement.DbContext.TeamUsers
30+
.Any(tu => tu.Team.EvaluationId == requirement.EvaluationId &&
31+
tu.UserId.ToString() == userId &&
32+
tu.CanSubmit);
33+
if (canSubmit)
2834
{
2935
context.Succeed(requirement);
3036
}

‎Cite.Api/Infrastructure/Authorization/EvaluationObserverRequirement.cs‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,34 @@
33

44
using Microsoft.AspNetCore.Authorization;
55
using System;
6+
using System.Linq;
67
using System.Threading.Tasks;
8+
using Cite.Api.Data;
79

810
namespace Cite.Api.Infrastructure.Authorization
911
{
1012
public class EvaluationObserverRequirement : IAuthorizationRequirement
1113
{
1214
public readonly Guid EvaluationId;
15+
public readonly CiteContext DbContext;
1316

14-
public EvaluationObserverRequirement(Guid evaluationId)
17+
public EvaluationObserverRequirement(Guid evaluationId, CiteContext dbContext)
1518
{
1619
EvaluationId = evaluationId;
20+
DbContext = dbContext;
1721
}
1822
}
1923

2024
public class EvaluationObserverHandler : AuthorizationHandler<EvaluationObserverRequirement>, IAuthorizationHandler
2125
{
2226
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, EvaluationObserverRequirement requirement)
2327
{
24-
if (context.User.HasClaim(c =>
25-
c.Type == CiteClaimTypes.EvaluationObserver.ToString() &&
26-
c.Value.Contains(requirement.EvaluationId.ToString())
27-
))
28+
var userId = context.User.Identities.First().Claims.First(c => c.Type == "sub")?.Value;
29+
var isObserver = requirement.DbContext.TeamUsers
30+
.Any(tu => tu.Team.EvaluationId == requirement.EvaluationId &&
31+
tu.UserId.ToString() == userId &&
32+
tu.IsObserver);
33+
if (isObserver)
2834
{
2935
context.Succeed(requirement);
3036
}

‎Cite.Api/Infrastructure/Authorization/EvaluationUserRequirement.cs‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,32 +3,34 @@
33

44
using Microsoft.AspNetCore.Authorization;
55
using System;
6+
using System.Linq;
67
using System.Threading.Tasks;
8+
using Cite.Api.Data;
79

810
namespace Cite.Api.Infrastructure.Authorization
911
{
1012
public class EvaluationUserRequirement : IAuthorizationRequirement
1113
{
1214
public readonly Guid EvaluationId;
15+
public readonly CiteContext DbContext;
1316

14-
public EvaluationUserRequirement(Guid evaluationId)
17+
public EvaluationUserRequirement(Guid evaluationId, CiteContext dbContext)
1518
{
1619
EvaluationId = evaluationId;
20+
DbContext = dbContext;
1721
}
1822
}
1923

2024
public class EvaluationUserHandler : AuthorizationHandler<EvaluationUserRequirement>, IAuthorizationHandler
2125
{
2226
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, EvaluationUserRequirement requirement)
2327
{
28+
var userId = context.User.Identities.First().Claims.First(c => c.Type == "sub")?.Value;
29+
var isEvaluationUser = requirement.DbContext.TeamUsers
30+
.Any(tu => tu.Team.EvaluationId == requirement.EvaluationId && tu.UserId.ToString() == userId);
2431
if (context.User.HasClaim(c => c.Type == CiteClaimTypes.SystemAdmin.ToString()) ||
2532
context.User.HasClaim(c => c.Type == CiteClaimTypes.ContentDeveloper.ToString()) ||
26-
(
27-
context.User.HasClaim(c =>
28-
c.Type == CiteClaimTypes.EvaluationUser.ToString() &&
29-
c.Value.Contains(requirement.EvaluationId.ToString())
30-
)
31-
)
33+
isEvaluationUser
3234
)
3335
{
3436
context.Succeed(requirement);

‎Cite.Api/Infrastructure/Authorization/TeamUserRequirement.cs‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,32 @@
33

44
using Microsoft.AspNetCore.Authorization;
55
using System;
6+
using System.Linq;
67
using System.Threading.Tasks;
8+
using Cite.Api.Data;
79

810
namespace Cite.Api.Infrastructure.Authorization
911
{
1012
public class TeamUserRequirement : IAuthorizationRequirement
1113
{
1214
public readonly Guid TeamId;
15+
public readonly CiteContext DbContext;
1316

14-
public TeamUserRequirement(Guid teamId)
17+
public TeamUserRequirement(Guid teamId, CiteContext dbContext)
1518
{
1619
TeamId = teamId;
20+
DbContext = dbContext;
1721
}
1822
}
1923

2024
public class TeamUserHandler : AuthorizationHandler<TeamUserRequirement>, IAuthorizationHandler
2125
{
2226
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, TeamUserRequirement requirement)
2327
{
24-
if (context.User.HasClaim(c =>
25-
c.Type == CiteClaimTypes.TeamUser.ToString() &&
26-
c.Value.Contains(requirement.TeamId.ToString()))
27-
)
28+
var userId = context.User.Identities.First().Claims.First(c => c.Type == "sub")?.Value;
29+
var isTeamUser = requirement.DbContext.TeamUsers
30+
.Any(tu => tu.TeamId == requirement.TeamId && tu.UserId.ToString() == userId);
31+
if (isTeamUser)
2832
{
2933
context.Succeed(requirement);
3034
}

‎Cite.Api/Infrastructure/EventHandlers/SubmissionHandler.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ private async Task<IEnumerable<Task>> GetAverageSubmissionTasks(
119119
else if (submission.TeamId != null)
120120
{
121121
var teamType = await _db.Teams.Select(t => t.TeamType).SingleOrDefaultAsync(t => t.Id == submission.TeamId);
122-
if (teamType.ShowTeamTypeAverage)
122+
if (teamType != null && teamType.ShowTeamTypeAverage)
123123
{
124124
// create the task to send the teamType average
125125
var averageSubmission = await _submissionService.GetTypeAverageAsync(_mapper.Map<ViewModels.Submission>(submission), cancellationToken);

‎Cite.Api/Services/ActionService.cs‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,8 @@ public ActionService(
5858
public async Task<IEnumerable<ViewModels.Action>> GetByEvaluationTeamAsync(Guid evaluationId, Guid teamId, CancellationToken ct)
5959
{
6060
// must be on the specified Team or an observer for the specified Evaluation
61-
if (!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(teamId))).Succeeded &&
62-
!(await _authorizationService.AuthorizeAsync(_user, null, new EvaluationObserverRequirement(evaluationId))).Succeeded
61+
if (!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(teamId, _context))).Succeeded &&
62+
!(await _authorizationService.AuthorizeAsync(_user, null, new EvaluationObserverRequirement(evaluationId, _context))).Succeeded
6363
)
6464
throw new ForbiddenException();
6565

@@ -92,7 +92,7 @@ public ActionService(
9292

9393
public async Task<IEnumerable<ViewModels.Action>> GetByEvaluationMoveTeamAsync(Guid evaluationId, int moveNumber, Guid teamId, CancellationToken ct)
9494
{
95-
if (!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(teamId))).Succeeded)
95+
if (!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(teamId, _context))).Succeeded)
9696
throw new ForbiddenException();
9797

9898
var actionEntities = await _context.Actions
@@ -114,7 +114,7 @@ public ActionService(
114114
if (item == null)
115115
throw new EntityNotFoundException<ActionEntity>();
116116

117-
if (!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(item.TeamId))).Succeeded)
117+
if (!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(item.TeamId, _context))).Succeeded)
118118
throw new ForbiddenException();
119119

120120
return _mapper.Map<ViewModels.Action>(item);
@@ -124,7 +124,7 @@ public ActionService(
124124
{
125125
// user must be on the requested team or a content developer
126126
if (
127-
!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(action.TeamId))).Succeeded &&
127+
!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(action.TeamId, _context))).Succeeded &&
128128
!(await _authorizationService.AuthorizeAsync(_user, null, new ContentDeveloperRequirement())).Succeeded
129129
)
130130
throw new ForbiddenException();
@@ -147,7 +147,7 @@ public ActionService(
147147
{
148148
// user must be on the requested team or a content developer
149149
if (
150-
!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(action.TeamId))).Succeeded &&
150+
!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(action.TeamId, _context))).Succeeded &&
151151
!(await _authorizationService.AuthorizeAsync(_user, null, new ContentDeveloperRequirement())).Succeeded
152152
)
153153
throw new ForbiddenException();
@@ -175,7 +175,7 @@ public ActionService(
175175
throw new EntityNotFoundException<ActionEntity>();
176176

177177
// user must be on the requested team
178-
if (!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(actionToUpdate.TeamId))).Succeeded)
178+
if (!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(actionToUpdate.TeamId, _context))).Succeeded)
179179
throw new ForbiddenException();
180180

181181
actionToUpdate.IsChecked = value;
@@ -194,7 +194,7 @@ public async Task<bool> DeleteAsync(Guid id, CancellationToken ct)
194194

195195
// user must be on the requested team or a content developer
196196
if (
197-
!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(actionToDelete.TeamId))).Succeeded &&
197+
!(await _authorizationService.AuthorizeAsync(_user, null, new TeamUserRequirement(actionToDelete.TeamId, _context))).Succeeded &&
198198
!(await _authorizationService.AuthorizeAsync(_user, null, new ContentDeveloperRequirement())).Succeeded
199199
)
200200
throw new ForbiddenException();

‎Cite.Api/Services/EvaluationService.cs‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,8 @@ public EvaluationService(
195195

196196
public async Task<ViewModels.Evaluation> UpdateAsync(Guid id, ViewModels.Evaluation evaluation, CancellationToken ct)
197197
{
198-
if (!(await _authorizationService.AuthorizeAsync(_user, null, new CanIncrementMoveRequirement(id))).Succeeded)
198+
if (!(await _authorizationService.AuthorizeAsync(_user, null, new ContentDeveloperRequirement())).Succeeded &&
199+
!(await _authorizationService.AuthorizeAsync(_user, null, new CanIncrementMoveRequirement(id, _context))).Succeeded)
199200
throw new ForbiddenException();
200201

201202
var evaluationToUpdate = await _context.Evaluations.SingleOrDefaultAsync(v => v.Id == id, ct);
@@ -267,7 +268,8 @@ public EvaluationService(
267268

268269
public async Task<ViewModels.Evaluation> UpdateSituationAsync(Guid id, EvaluationSituation evaluationSituation, CancellationToken ct)
269270
{
270-
if (!(await _authorizationService.AuthorizeAsync(_user, null, new CanIncrementMoveRequirement(id))).Succeeded)
271+
if (!(await _authorizationService.AuthorizeAsync(_user, null, new ContentDeveloperRequirement())).Succeeded &&
272+
!(await _authorizationService.AuthorizeAsync(_user, null, new CanIncrementMoveRequirement(id, _context))).Succeeded)
271273
throw new ForbiddenException();
272274

273275
var evaluationToUpdate = await _context.Evaluations.SingleOrDefaultAsync(v => v.Id == id, ct);
@@ -287,7 +289,8 @@ public EvaluationService(
287289

288290
public async Task<ViewModels.Evaluation> SetCurrentMoveAsync(Guid id, int moveNumber, CancellationToken ct)
289291
{
290-
if (!(await _authorizationService.AuthorizeAsync(_user, null, new CanIncrementMoveRequirement(id))).Succeeded)
292+
if (!(await _authorizationService.AuthorizeAsync(_user, null, new ContentDeveloperRequirement())).Succeeded &&
293+
!(await _authorizationService.AuthorizeAsync(_user, null, new CanIncrementMoveRequirement(id, _context))).Succeeded)
291294
throw new ForbiddenException();
292295

293296
var evaluationToUpdate = await _context.Evaluations

0 commit comments

Comments
 (0)