commit 3c161f5b06da49cca098fcafb70a97e7373b62d9
Author: Vojtěch Bartička <aitakaitov@gmail.com>
Date:   Sun Apr 10 15:37:57 2022 +0200

    Added ERole check to [Authorize] attribute
    
    [Authorize] has ERole.ANNOTATOR as default, ERole can be specified as a parameter

diff --git a/Backend/Backend/Authentication/AuthorizationAttribute.cs b/Backend/Backend/Authentication/AuthorizationAttribute.cs
index f8d0808..e325126 100644
--- a/Backend/Backend/Authentication/AuthorizationAttribute.cs
+++ b/Backend/Backend/Authentication/AuthorizationAttribute.cs
@@ -1,4 +1,5 @@
 using Core.Entities;
+using Core.Enums;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
@@ -8,6 +9,18 @@ namespace RestAPI.Authentication;
 [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
 public class AuthorizeAttribute : Attribute, IAuthorizationFilter
 {
+    private readonly ERole MinimumRequiredPermissions;
+
+    public AuthorizeAttribute(ERole role = ERole.ANNOTATOR)
+    {
+        MinimumRequiredPermissions = role;
+    }
+
+    public AuthorizeAttribute()
+    {
+        MinimumRequiredPermissions = ERole.ANNOTATOR;
+    }
+
     public void OnAuthorization(AuthorizationFilterContext context)
     {
         // skip authorization if action is decorated with [AllowAnonymous] attribute
@@ -16,9 +29,22 @@ public class AuthorizeAttribute : Attribute, IAuthorizationFilter
             return;
 
         // authorization
-        var user = (User?) context.HttpContext.Items["User"];
+        var user = (User?)context.HttpContext.Items["User"];
         if (user == null)
-            context.Result = new JsonResult(new {message = "Unauthorized"})
-                {StatusCode = StatusCodes.Status401Unauthorized};
+        {
+            context.Result = new JsonResult(new { message = "Unauthorized" })
+            {
+                StatusCode = StatusCodes.Status401Unauthorized
+            };
+        }
+
+        if (MinimumRequiredPermissions > user.Role)
+        {
+            context.Result = new JsonResult(new { message = "Unauthorized" })
+            {
+                StatusCode = StatusCodes.Status401Unauthorized
+            };
+        }
+
     }
 }
\ No newline at end of file
diff --git a/Backend/Backend/Controllers/DocumentController.cs b/Backend/Backend/Controllers/DocumentController.cs
index 6a465f5..4422694 100644
--- a/Backend/Backend/Controllers/DocumentController.cs
+++ b/Backend/Backend/Controllers/DocumentController.cs
@@ -6,6 +6,7 @@ using Serilog;
 using ILogger = Serilog.ILogger;
 using Models.Documents;
 using RestAPI.Exceptions;
+using RestAPI.Authentication;
 
 namespace RestAPI.Controllers;
 
@@ -27,6 +28,7 @@ public class DocumentController : Common.CommonControllerBase
     [ProducesResponseType((int)HttpStatusCode.OK)]
     [ProducesResponseType((int)HttpStatusCode.Forbidden)]
     [ProducesResponseType((int)HttpStatusCode.InternalServerError)]
+    [Authorize(Core.Enums.ERole.ADMINISTRATOR)]
     public ActionResult<DocumentListResponse> GetDocuments([FromServices] ClientInfo clientInfo, [FromBody] DocumentListRequest documentListRequest)
     {
         if (clientInfo.LoggedUser == null)
@@ -35,11 +37,6 @@ public class DocumentController : Common.CommonControllerBase
             return Problem();
         }
 
-        if (clientInfo.LoggedUser.Role != Core.Enums.ERole.ADMINISTRATOR)
-        {
-            return Forbid("User is not administrator");
-        }
-
         return documentService.GetDocuments(documentListRequest);
     }
 
@@ -48,6 +45,7 @@ public class DocumentController : Common.CommonControllerBase
     [ProducesResponseType((int)HttpStatusCode.Forbidden)]
     [ProducesResponseType((int)HttpStatusCode.InternalServerError)]
     [ProducesResponseType((int)HttpStatusCode.UnsupportedMediaType)]
+    [Authorize(Core.Enums.ERole.ADMINISTRATOR)]
     public ActionResult PostDocuments([FromServices] ClientInfo clientInfo, [FromBody] DocumentAddRequest documentAddRequest)
     {
         if (clientInfo.LoggedUser == null)
@@ -56,11 +54,6 @@ public class DocumentController : Common.CommonControllerBase
             return Problem();
         }
 
-        if (clientInfo.LoggedUser.Role != Core.Enums.ERole.ADMINISTRATOR)
-        {
-            return Forbid("User is not administrator");
-        }
-
         try
         {
             documentService.AddDocuments(documentAddRequest, clientInfo.LoggedUser.Id);
