Revize 3c161f5b

Added ERole check to [Authorize] attribute

[Authorize] has ERole.ANNOTATOR as default, ERole can be specified as a parameter

Backend/Backend/Authentication/AuthorizationAttribute.cs

@@ -1 +1 @@
 using Core.Entities;
+using Core.Enums;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
@@ -8 +9 @@
 [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
 public class AuthorizeAttribute : Attribute, IAuthorizationFilter
 {
+    private readonly ERole MinimumRequiredPermissions;
+
+    public AuthorizeAttribute(ERole role = ERole.ANNOTATOR)
+    {
+        MinimumRequiredPermissions = role;
+    }
+
+    public AuthorizeAttribute()
+    {
+        MinimumRequiredPermissions = ERole.ANNOTATOR;
+    }
+
     public void OnAuthorization(AuthorizationFilterContext context)
     {
         // skip authorization if action is decorated with [AllowAnonymous] attribute
@@ -16 +29 @@
             return;
 
         // authorization
-        var user = (User?) context.HttpContext.Items["User"];
+        var user = (User?)context.HttpContext.Items["User"];
         if (user == null)
-            context.Result = new JsonResult(new {message = "Unauthorized"})
-                {StatusCode = StatusCodes.Status401Unauthorized};
+        {
+            context.Result = new JsonResult(new { message = "Unauthorized" })
+            {
+                StatusCode = StatusCodes.Status401Unauthorized
+            };
+        }
+
+        if (MinimumRequiredPermissions > user.Role)
+        {
+            context.Result = new JsonResult(new { message = "Unauthorized" })
+            {
+                StatusCode = StatusCodes.Status401Unauthorized
+            };
+        }
+
     }
 }

Backend/Backend/Controllers/DocumentController.cs

@@ -6 +6 @@
 using ILogger = Serilog.ILogger;
 using Models.Documents;
 using RestAPI.Exceptions;
+using RestAPI.Authentication;
 
 namespace RestAPI.Controllers;
 
@@ -27 +28 @@
     [ProducesResponseType((int)HttpStatusCode.OK)]
     [ProducesResponseType((int)HttpStatusCode.Forbidden)]
     [ProducesResponseType((int)HttpStatusCode.InternalServerError)]
+    [Authorize(Core.Enums.ERole.ADMINISTRATOR)]
     public ActionResult<DocumentListResponse> GetDocuments([FromServices] ClientInfo clientInfo, [FromBody] DocumentListRequest documentListRequest)
     {
         if (clientInfo.LoggedUser == null)
@@ -35 +37 @@
             return Problem();
         }
 
-        if (clientInfo.LoggedUser.Role != Core.Enums.ERole.ADMINISTRATOR)
-        {
-            return Forbid("User is not administrator");
-        }
-
         return documentService.GetDocuments(documentListRequest);
     }
 
@@ -48 +45 @@
     [ProducesResponseType((int)HttpStatusCode.Forbidden)]
     [ProducesResponseType((int)HttpStatusCode.InternalServerError)]
     [ProducesResponseType((int)HttpStatusCode.UnsupportedMediaType)]
+    [Authorize(Core.Enums.ERole.ADMINISTRATOR)]
     public ActionResult PostDocuments([FromServices] ClientInfo clientInfo, [FromBody] DocumentAddRequest documentAddRequest)
     {
         if (clientInfo.LoggedUser == null)
@@ -56 +54 @@
             return Problem();
         }
 
-        if (clientInfo.LoggedUser.Role != Core.Enums.ERole.ADMINISTRATOR)
-        {
-            return Forbid("User is not administrator");
-        }
-
         try
         {
             documentService.AddDocuments(documentAddRequest, clientInfo.LoggedUser.Id);