diff options
Diffstat (limited to 'code/api/src/Endpoints')
32 files changed, 1223 insertions, 0 deletions
diff --git a/code/api/src/Endpoints/EndpointBase.cs b/code/api/src/Endpoints/EndpointBase.cs new file mode 100644 index 0000000..105fbdf --- /dev/null +++ b/code/api/src/Endpoints/EndpointBase.cs @@ -0,0 +1,54 @@ +using ILogger = Microsoft.Extensions.Logging.ILogger; + +namespace IOL.GreatOffice.Api.Endpoints; + +[ApiController] +public class EndpointBase : ControllerBase +{ + /// <summary> + /// User data for the currently logged on user. + /// </summary> + protected LoggedInUserModel LoggedInUser => new() { + Username = User.FindFirstValue(AppClaims.NAME), + Id = User.FindFirstValue(AppClaims.USER_ID).AsGuid(), + }; + + [NonAction] + protected ActionResult KnownProblem(string title = default, string subtitle = default, Dictionary<string, string[]> errors = default) { + HttpContext.Response.Headers.Add(AppHeaders.IS_KNOWN_PROBLEM, "1"); + return BadRequest(new KnownProblemModel { + Title = title, + Subtitle = subtitle, + Errors = errors, + TraceId = HttpContext.TraceIdentifier + }); + } + + [NonAction] + protected ActionResult KnownProblem(KnownProblemModel problem) { + HttpContext.Response.Headers.Add(AppHeaders.IS_KNOWN_PROBLEM, "1"); + problem.TraceId = HttpContext.TraceIdentifier; + return BadRequest(problem); + } + + [NonAction] + protected RequestTimeZoneInfo GetRequestTimeZone(ILogger logger = default) { + Request.Headers.TryGetValue(AppHeaders.BROWSER_TIME_ZONE, out var timeZoneHeader); + var tz = TimeZoneInfo.FindSystemTimeZoneById(timeZoneHeader.ToString().HasValue() ? timeZoneHeader.ToString() : "UTC"); + var offset = tz.BaseUtcOffset.Hours; + + // This is fine as long as the client is not connecting from Australia: Lord Howe Island, + // according to https://en.wikipedia.org/wiki/Daylight_saving_time_by_country + if (tz.IsDaylightSavingTime(AppDateTime.UtcNow)) { + offset++; + } + + logger?.LogInformation("Request time zone (" + tz.Id + ") offset is: " + offset + " hours"); + + return new RequestTimeZoneInfo() { + TimeZoneInfo = tz, + Offset = offset, + LocalDateTime = TimeZoneInfo.ConvertTimeFromUtc(AppDateTime.UtcNow, tz) + }; + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Account/CreateAccountRoute.cs b/code/api/src/Endpoints/Internal/Account/CreateAccountRoute.cs new file mode 100644 index 0000000..ee136a9 --- /dev/null +++ b/code/api/src/Endpoints/Internal/Account/CreateAccountRoute.cs @@ -0,0 +1,64 @@ +using ILogger = Microsoft.Extensions.Logging.ILogger; + +namespace IOL.GreatOffice.Api.Endpoints.Internal.Account; + +public class CreateAccountRoute : RouteBaseAsync.WithRequest<CreateAccountRoute.Payload>.WithActionResult +{ + private readonly MainAppDatabase _database; + private readonly UserService _userService; + private readonly IStringLocalizer<SharedResources> _localizer; + private readonly EmailValidationService _emailValidation; + private readonly ILogger<CreateAccountRoute> _logger; + private readonly TenantService _tenantService; + + public CreateAccountRoute(UserService userService, MainAppDatabase database, IStringLocalizer<SharedResources> localizer, EmailValidationService emailValidation, TenantService tenantService, ILogger<CreateAccountRoute> logger) { + _userService = userService; + _database = database; + _localizer = localizer; + _emailValidation = emailValidation; + _tenantService = tenantService; + _logger = logger; + } + + public class Payload + { + public string Username { get; set; } + public string Password { get; set; } + } + + [AllowAnonymous] + [HttpPost("~/_/account/create")] + public override async Task<ActionResult> HandleAsync(Payload request, CancellationToken cancellationToken = default) { + var problem = new KnownProblemModel(); + var username = request.Username.Trim(); + if (username.IsValidEmailAddress() == false) { + problem.AddError("username", _localizer["{username} does not look like a valid email", username]); + } else if (_database.Users.FirstOrDefault(c => c.Username == username) != default) { + problem.AddError("username", _localizer["There is already a user registered with username: {username}", username]); + } + + if (request.Password.Length < 6) { + problem.AddError("password", _localizer["The password requires 6 or more characters."]); + } + + if (problem.Errors.Any()) { + problem.Title = _localizer["Invalid form"]; + problem.Subtitle = _localizer["One or more fields is invalid"]; + return KnownProblem(problem); + } + + var user = new User(username); + var tenant = _tenantService.CreateTenant(user.DisplayName() + "'s tenant", user.Id, user.Username); + if (tenant == default) { + _logger.LogError("Not creating new user because the tenant could not be created"); + return KnownProblem(_localizer["Could not create your account, try again soon."]); + } + + user.HashAndSetPassword(request.Password); + _database.Users.Add(user); + await _database.SaveChangesAsync(cancellationToken); + await _userService.LogInUserAsync(HttpContext, user, false, cancellationToken); + await _emailValidation.SendValidationEmailAsync(user); + return Ok(); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Account/CreateInitialAccountRoute.cs b/code/api/src/Endpoints/Internal/Account/CreateInitialAccountRoute.cs new file mode 100644 index 0000000..e1d13dd --- /dev/null +++ b/code/api/src/Endpoints/Internal/Account/CreateInitialAccountRoute.cs @@ -0,0 +1,32 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Account; + +public class CreateInitialAccountRoute : RouteBaseAsync.WithoutRequest.WithActionResult +{ + private readonly MainAppDatabase _database; + private readonly UserService _userService; + + public CreateInitialAccountRoute(MainAppDatabase database, UserService userService) { + _database = database; + _userService = userService; + } + + /// <summary> + /// Create an initial user account. + /// </summary> + /// <param name="cancellationToken"></param> + /// <returns></returns> + [AllowAnonymous] + [HttpGet("~/_/account/create-initial")] + public override async Task<ActionResult> HandleAsync(CancellationToken cancellationToken = default) { + if (_database.Users.Any()) { + return NotFound(); + } + + var user = new User("admin@ivarlovlie.no"); + user.HashAndSetPassword("ivar123"); + _database.Users.Add(user); + await _database.SaveChangesAsync(cancellationToken); + await _userService.LogInUserAsync(HttpContext, user, cancellationToken: cancellationToken); + return Redirect("/"); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Account/DeleteAccountRoute.cs b/code/api/src/Endpoints/Internal/Account/DeleteAccountRoute.cs new file mode 100644 index 0000000..f487f74 --- /dev/null +++ b/code/api/src/Endpoints/Internal/Account/DeleteAccountRoute.cs @@ -0,0 +1,17 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Account; + +public class DeleteAccountRoute : RouteBaseAsync.WithoutRequest.WithActionResult +{ + private readonly UserService _userService; + + public DeleteAccountRoute(UserService userService) { + _userService = userService; + } + + [HttpDelete("~/_/account/delete")] + public override async Task<ActionResult> HandleAsync(CancellationToken cancellationToken = default) { + await _userService.LogOutUser(HttpContext, cancellationToken); + await _userService.MarkUserAsDeleted(LoggedInUser.Id, LoggedInUser.Id); + return Ok(); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Account/GetAccountRoute.cs b/code/api/src/Endpoints/Internal/Account/GetAccountRoute.cs new file mode 100644 index 0000000..121b40f --- /dev/null +++ b/code/api/src/Endpoints/Internal/Account/GetAccountRoute.cs @@ -0,0 +1,26 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Account; + +public class GetAccountRoute : RouteBaseAsync.WithoutRequest.WithActionResult<LoggedInUserModel> +{ + private readonly MainAppDatabase _database; + + public GetAccountRoute(MainAppDatabase database) { + _database = database; + } + + [HttpGet("~/_/account")] + public override async Task<ActionResult<LoggedInUserModel>> HandleAsync(CancellationToken cancellationToken = default) { + var user = _database.Users + .Select(x => new {x.Username, x.Id}) + .SingleOrDefault(c => c.Id == LoggedInUser.Id); + if (user != default) { + return Ok(new LoggedInUserModel { + Id = LoggedInUser.Id, + Username = LoggedInUser.Username + }); + } + + await HttpContext.SignOutAsync(); + return Unauthorized(); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Account/LoginRoute.cs b/code/api/src/Endpoints/Internal/Account/LoginRoute.cs new file mode 100644 index 0000000..703f324 --- /dev/null +++ b/code/api/src/Endpoints/Internal/Account/LoginRoute.cs @@ -0,0 +1,37 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Account; + +public class LoginRoute : RouteBaseAsync.WithRequest<LoginRoute.Payload>.WithActionResult +{ + private readonly MainAppDatabase _database; + private readonly UserService _userService; + private readonly IStringLocalizer<SharedResources> _localizer; + + public LoginRoute(MainAppDatabase database, UserService userService, IStringLocalizer<SharedResources> localizer) { + _database = database; + _userService = userService; + _localizer = localizer; + } + + public class Payload + { + public string Username { get; set; } + public string Password { get; set; } + public bool Persist { get; set; } + } + + [AllowAnonymous] + [HttpPost("~/_/account/login")] + public override async Task<ActionResult> HandleAsync(Payload request, CancellationToken cancellationToken = default) { + var user = _database.Users.FirstOrDefault(u => u.Username == request.Username); + if (user == default || !user.VerifyPassword(request.Password)) { + return KnownProblem(_localizer["Invalid username or password"]); + } + + if (user.Deleted) { + return KnownProblem(_localizer["This user is deleted, please contact support@greatoffice.life if you think this is an error"]); + } + + await _userService.LogInUserAsync(HttpContext, user, request.Persist, cancellationToken); + return Ok(); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Account/LogoutRoute.cs b/code/api/src/Endpoints/Internal/Account/LogoutRoute.cs new file mode 100644 index 0000000..295d9f6 --- /dev/null +++ b/code/api/src/Endpoints/Internal/Account/LogoutRoute.cs @@ -0,0 +1,22 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Account; + +public class LogoutRoute : RouteBaseAsync.WithoutRequest.WithActionResult +{ + private readonly UserService _userService; + + public LogoutRoute(UserService userService) { + _userService = userService; + } + + /// <summary> + /// Logout a user. + /// </summary> + /// <param name="cancellationToken"></param> + /// <returns></returns> + [AllowAnonymous] + [HttpGet("~/_/account/logout")] + public override async Task<ActionResult> HandleAsync(CancellationToken cancellationToken = default) { + await _userService.LogOutUser(HttpContext, cancellationToken); + return Ok(); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Account/UpdateAccountRoute.cs b/code/api/src/Endpoints/Internal/Account/UpdateAccountRoute.cs new file mode 100644 index 0000000..1081240 --- /dev/null +++ b/code/api/src/Endpoints/Internal/Account/UpdateAccountRoute.cs @@ -0,0 +1,59 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Account; + +public class UpdateAccountRoute : RouteBaseAsync.WithRequest<UpdateAccountRoute.Payload>.WithActionResult +{ + private readonly MainAppDatabase _database; + private readonly IStringLocalizer<SharedResources> _localizer; + + public UpdateAccountRoute(MainAppDatabase database, IStringLocalizer<SharedResources> localizer) { + _database = database; + _localizer = localizer; + } + + public class Payload + { + public string Username { get; set; } + + public string Password { get; set; } + } + + [HttpPost("~/_/account/update")] + public override async Task<ActionResult> HandleAsync(Payload request, CancellationToken cancellationToken = default) { + var user = _database.Users.SingleOrDefault(c => c.Id == LoggedInUser.Id); + if (user == default) { + await HttpContext.SignOutAsync(); + return Unauthorized(); + } + + if (request.Password.IsNullOrWhiteSpace() && request.Username.IsNullOrWhiteSpace()) { + return KnownProblem(_localizer["Invalid request"], _localizer["No data was submitted"]); + } + + var problem = new KnownProblemModel(); + + if (request.Password.HasValue() && request.Password.Length < 6) { + problem.AddError("password", _localizer["The new password must contain at least 6 characters"]); + } + + if (request.Password.HasValue()) { + user.HashAndSetPassword(request.Password); + } + + if (request.Username.HasValue() && !request.Username.IsValidEmailAddress()) { + problem.AddError("username", _localizer["The new username does not look like a valid email address"]); + } + + if (problem.Errors.Any()) { + problem.Title = _localizer["Invalid form"]; + problem.Subtitle = _localizer["One or more validation errors occured"]; + return KnownProblem(problem); + } + + if (request.Username.HasValue()) { + user.Username = request.Username.Trim(); + } + + await _database.SaveChangesAsync(cancellationToken); + return Ok(); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Account/_calls.http b/code/api/src/Endpoints/Internal/Account/_calls.http new file mode 100644 index 0000000..78380f5 --- /dev/null +++ b/code/api/src/Endpoints/Internal/Account/_calls.http @@ -0,0 +1,9 @@ +### Login +POST http://localhost:5000/_/account/login +Content-Type: application/json + +{ + "username": "i@oiee.no", + "password": "ivar123", + "persist": false +} diff --git a/code/api/src/Endpoints/Internal/INT_EndpointBase.cs b/code/api/src/Endpoints/Internal/INT_EndpointBase.cs new file mode 100644 index 0000000..699a976 --- /dev/null +++ b/code/api/src/Endpoints/Internal/INT_EndpointBase.cs @@ -0,0 +1,9 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal; + +[Authorize] +[ApiExplorerSettings(IgnoreApi = true)] +[ApiVersionNeutral] +public class INT_EndpointBase : EndpointBase +{ + +} diff --git a/code/api/src/Endpoints/Internal/PasswordResetRequests/CreateResetRequestRoute.cs b/code/api/src/Endpoints/Internal/PasswordResetRequests/CreateResetRequestRoute.cs new file mode 100644 index 0000000..c6ed417 --- /dev/null +++ b/code/api/src/Endpoints/Internal/PasswordResetRequests/CreateResetRequestRoute.cs @@ -0,0 +1,40 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.PasswordResetRequests; + +public class CreateResetRequestRoute : RouteBaseAsync.WithRequest<CreateResetRequestRoute.Payload>.WithActionResult +{ + private readonly ILogger<CreateResetRequestRoute> _logger; + private readonly PasswordResetService _passwordResetService; + private readonly MainAppDatabase _database; + private readonly IStringLocalizer<SharedResources> _localizer; + + public CreateResetRequestRoute(ILogger<CreateResetRequestRoute> logger, PasswordResetService passwordResetService, MainAppDatabase database, IStringLocalizer<SharedResources> localizer) { + _logger = logger; + _passwordResetService = passwordResetService; + _database = database; + _localizer = localizer; + } + + public class Payload + { + public string Email { get; set; } + } + + [AllowAnonymous] + [HttpPost("~/_/password-reset-request/create")] + public override async Task<ActionResult> HandleAsync(Payload payload, CancellationToken cancellationToken = default) { + if (payload.Email.IsNullOrWhiteSpace()) { + return KnownProblem(_localizer["Invalid form"], + _localizer["One or more fields is invalid"], + new() {{"email", new string[] {_localizer["Email is a required field"]}}} + ); + } + + var tz = GetRequestTimeZone(_logger); + _logger.LogInformation("Creating forgot password request with local date time: " + tz.LocalDateTime.ToString("u")); + var user = _database.Users.FirstOrDefault(c => c.Username.Equals(payload.Email)); + // Don't inform the caller that the user does not exist. + if (user == default) return Ok(); + await _passwordResetService.AddRequestAsync(user, tz.TimeZoneInfo, cancellationToken); + return Ok(); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/PasswordResetRequests/FulfillResetRequestRoute.cs b/code/api/src/Endpoints/Internal/PasswordResetRequests/FulfillResetRequestRoute.cs new file mode 100644 index 0000000..9cd92bb --- /dev/null +++ b/code/api/src/Endpoints/Internal/PasswordResetRequests/FulfillResetRequestRoute.cs @@ -0,0 +1,36 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.PasswordResetRequests; + +public class FulfillResetRequestRoute : RouteBaseAsync.WithRequest<FulfillResetRequestRoute.Payload>.WithActionResult +{ + private readonly IStringLocalizer<SharedResources> _localizer; + private readonly PasswordResetService _passwordResetService; + + public FulfillResetRequestRoute(PasswordResetService passwordResetService, IStringLocalizer<SharedResources> localizer) { + _passwordResetService = passwordResetService; + _localizer = localizer; + } + + public class Payload + { + public Guid Id { get; set; } + public string NewPassword { get; set; } + } + + [AllowAnonymous] + [HttpPost("~/_/password-reset-request/fulfill")] + public override async Task<ActionResult> HandleAsync(Payload request, CancellationToken cancellationToken = default) { + if (request.NewPassword.Length < 6) { + return KnownProblem(_localizer["Invalid form"], + _localizer["One or more fields is invalid"], + new Dictionary<string, string[]> {{"newPassword", new string[] {_localizer["The new password needs to be atleast 6 characters"]}}} + ); + } + + return await _passwordResetService.FulfillRequestAsync(request.Id, request.NewPassword, cancellationToken) switch { + FulfillPasswordResetRequestResult.REQUEST_NOT_FOUND => NotFound(), + FulfillPasswordResetRequestResult.USER_NOT_FOUND => NotFound(), + FulfillPasswordResetRequestResult.FULFILLED => Ok(), + _ => StatusCode(500) + }; + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/PasswordResetRequests/IsResetRequestValidRoute.cs b/code/api/src/Endpoints/Internal/PasswordResetRequests/IsResetRequestValidRoute.cs new file mode 100644 index 0000000..a87c0a9 --- /dev/null +++ b/code/api/src/Endpoints/Internal/PasswordResetRequests/IsResetRequestValidRoute.cs @@ -0,0 +1,26 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.PasswordResetRequests; + +public class IsResetRequestValidRoute : RouteBaseAsync.WithRequest<Guid>.WithActionResult<IsResetRequestValidRoute.ResponseModel> +{ + private readonly PasswordResetService _passwordResetService; + + public IsResetRequestValidRoute(PasswordResetService passwordResetService) { + _passwordResetService = passwordResetService; + } + + public class ResponseModel + { + public ResponseModel(bool isValid) { + IsValid = isValid; + } + + public bool IsValid { get; } + } + + [AllowAnonymous] + [HttpGet("~/_/password-reset-request/is-valid")] + public override async Task<ActionResult<ResponseModel>> HandleAsync(Guid id, CancellationToken cancellationToken = default) { + var request = await _passwordResetService.GetRequestAsync(id, cancellationToken); + return Ok(request == default ? new ResponseModel(false) : new ResponseModel(!request.IsExpired)); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/PasswordResetRequests/_calls.http b/code/api/src/Endpoints/Internal/PasswordResetRequests/_calls.http new file mode 100644 index 0000000..cfd2d58 --- /dev/null +++ b/code/api/src/Endpoints/Internal/PasswordResetRequests/_calls.http @@ -0,0 +1,22 @@ +### Create request +POST http://localhost:5000/_/password-reset-request/create +Accept: application/json +Content-Type: application/json + +{ + "email": "" +} + +### Fulfill request +POST http://localhost:5000/_/password-reset-request/fulfill +Accept: application/json +Content-Type: application/json + +{ + "id": "", + "newPassword": "" +} + +### Is request valid +GET http://localhost:5000/_/password-reset-request/is-valid?id= +Accept: application/json diff --git a/code/api/src/Endpoints/Internal/Root/GetSessionRoute.cs b/code/api/src/Endpoints/Internal/Root/GetSessionRoute.cs new file mode 100644 index 0000000..82bbb11 --- /dev/null +++ b/code/api/src/Endpoints/Internal/Root/GetSessionRoute.cs @@ -0,0 +1,64 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Root; + +public class GetSessionRoute : RouteBaseSync.WithoutRequest.WithActionResult<GetSessionRoute.SessionResponse> +{ + private readonly MainAppDatabase _database; + private readonly ILogger<GetSessionRoute> _logger; + + public GetSessionRoute(MainAppDatabase database, ILogger<GetSessionRoute> logger) { + _database = database; + _logger = logger; + } + + public class SessionResponse + { + public string Username { get; set; } + public string DisplayName { get; set; } + public Guid UserId { get; set; } + public SessionTenant CurrentTenant { get; set; } + public List<SessionTenant> AvailableTenants { get; set; } + + public class SessionTenant + { + public Guid Id { get; set; } + public string Name { get; set; } + } + } + + [Authorize] + [HttpGet("~/_/session-data")] + public override ActionResult<SessionResponse> Handle() { + var user = _database.Users.Include(c => c.Tenants) + .Select(c => new User() { + Id = c.Id, + Username = c.Username, + FirstName = c.FirstName, + LastName = c.LastName, + Tenants = c.Tenants + }).FirstOrDefault(c => c.Id == LoggedInUser.Id); + + if (user == default) { + return NotFound(); + } + + var currentTenant = user.Tenants.FirstOrDefault(c => c.Id == LoggedInUser.TenantId); + if (currentTenant == default) { + _logger.LogInformation("Could not find current tenant ({tenantId}) for user {userId}", LoggedInUser.TenantId, LoggedInUser.Id); + return NotFound(); + } + + return Ok(new SessionResponse() { + Username = user.Username, + DisplayName = user.DisplayName(), + UserId = user.Id, + CurrentTenant = new SessionResponse.SessionTenant() { + Id = currentTenant.Id, + Name = currentTenant.Name + }, + AvailableTenants = user.Tenants.Select(c => new SessionResponse.SessionTenant() { + Id = c.Id, + Name = c.Name + }).ToList() + }); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Root/IsAuthenticatedRoute.cs b/code/api/src/Endpoints/Internal/Root/IsAuthenticatedRoute.cs new file mode 100644 index 0000000..7bb0a86 --- /dev/null +++ b/code/api/src/Endpoints/Internal/Root/IsAuthenticatedRoute.cs @@ -0,0 +1,10 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Root; + +public class IsAuthenticatedRoute : RouteBaseSync.WithoutRequest.WithActionResult +{ + [Authorize] + [HttpGet("~/_/is-authenticated")] + public override ActionResult Handle() { + return Ok(); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Root/ReadConfigurationRoute.cs b/code/api/src/Endpoints/Internal/Root/ReadConfigurationRoute.cs new file mode 100644 index 0000000..7270fd8 --- /dev/null +++ b/code/api/src/Endpoints/Internal/Root/ReadConfigurationRoute.cs @@ -0,0 +1,17 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Root; + +public class ReadConfigurationRoute : RouteBaseSync.WithoutRequest.WithActionResult +{ + private readonly VaultService _vaultService; + + public ReadConfigurationRoute(VaultService vaultService) { + _vaultService = vaultService; + } + + [AllowAnonymous] + [HttpGet("~/_/configuration")] + public override ActionResult Handle() { + var config = _vaultService.GetCurrentAppConfiguration(); + return Content(JsonSerializer.Serialize(config.GetPublicVersion()), "application/json"); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Root/RefreshConfigurationRoute.cs b/code/api/src/Endpoints/Internal/Root/RefreshConfigurationRoute.cs new file mode 100644 index 0000000..fde4832 --- /dev/null +++ b/code/api/src/Endpoints/Internal/Root/RefreshConfigurationRoute.cs @@ -0,0 +1,15 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Root; + +public class RefreshConfigurationRoute : RouteBaseSync.WithoutRequest.WithoutResult +{ + private readonly VaultService _vaultService; + + public RefreshConfigurationRoute(VaultService vaultService) { + _vaultService = vaultService; + } + + [HttpGet("~/_/refresh-configuration")] + public override void Handle() { + _vaultService.RefreshCurrentAppConfigurationAsync(); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/Root/ValidateRoute.cs b/code/api/src/Endpoints/Internal/Root/ValidateRoute.cs new file mode 100644 index 0000000..8f0882d --- /dev/null +++ b/code/api/src/Endpoints/Internal/Root/ValidateRoute.cs @@ -0,0 +1,39 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal.Root; + +public class ValidateRoute : RouteBaseSync.WithRequest<ValidateRoute.QueryParams>.WithActionResult +{ + private readonly EmailValidationService _emailValidation; + private readonly string CanonicalFrontendUrl; + private readonly ILogger<ValidateRoute> _logger; + + public ValidateRoute(VaultService vaultService, EmailValidationService emailValidation, ILogger<ValidateRoute> logger) { + _emailValidation = emailValidation; + _logger = logger; + var c = vaultService.GetCurrentAppConfiguration(); + CanonicalFrontendUrl = c.CANONICAL_FRONTEND_URL; + } + + public class QueryParams + { + [FromQuery] + public Guid Id { get; set; } + } + + [HttpGet("~/_/validate")] + public override ActionResult Handle([FromQuery] QueryParams request) { + var isFulfilled = _emailValidation.FulfillEmailValidationRequest(request.Id, LoggedInUser.Id); + if (!isFulfilled) { + _logger.LogError("Email validation fulfillment failed for request {requestId} and user {userId}", request.Id, LoggedInUser.Id); + return StatusCode(400, $""" +<html> +<body> +<h3>The validation could not be completed</h3> +<p>We are working on fixing this, in the meantime, have patience.</p> +<a href="{CanonicalFrontendUrl}">Click here to go back to {CanonicalFrontendUrl}</a> +</body> +"""); + } + + return Redirect(CanonicalFrontendUrl + "/portal?msg=emailValidated"); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/Internal/RouteBaseAsync.cs b/code/api/src/Endpoints/Internal/RouteBaseAsync.cs new file mode 100644 index 0000000..a87facf --- /dev/null +++ b/code/api/src/Endpoints/Internal/RouteBaseAsync.cs @@ -0,0 +1,73 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal; + +/// <summary> +/// A base class for an endpoint that accepts parameters. +/// </summary> +public static class RouteBaseAsync +{ + public static class WithRequest<TRequest> + { + public abstract class WithResult<TResponse> : INT_EndpointBase + { + public abstract Task<TResponse> HandleAsync( + TRequest request, + CancellationToken cancellationToken = default + ); + } + + public abstract class WithoutResult : INT_EndpointBase + { + public abstract Task HandleAsync( + TRequest request, + CancellationToken cancellationToken = default + ); + } + + public abstract class WithActionResult<TResponse> : INT_EndpointBase + { + public abstract Task<ActionResult<TResponse>> HandleAsync( + TRequest request, + CancellationToken cancellationToken = default + ); + } + + public abstract class WithActionResult : INT_EndpointBase + { + public abstract Task<ActionResult> HandleAsync( + TRequest request, + CancellationToken cancellationToken = default + ); + } + } + + public static class WithoutRequest + { + public abstract class WithResult<TResponse> : INT_EndpointBase + { + public abstract Task<TResponse> HandleAsync( + CancellationToken cancellationToken = default + ); + } + + public abstract class WithoutResult : INT_EndpointBase + { + public abstract Task HandleAsync( + CancellationToken cancellationToken = default + ); + } + + public abstract class WithActionResult<TResponse> : INT_EndpointBase + { + public abstract Task<ActionResult<TResponse>> HandleAsync( + CancellationToken cancellationToken = default + ); + } + + public abstract class WithActionResult : INT_EndpointBase + { + public abstract Task<ActionResult> HandleAsync( + CancellationToken cancellationToken = default + ); + } + } +} diff --git a/code/api/src/Endpoints/Internal/RouteBaseSync.cs b/code/api/src/Endpoints/Internal/RouteBaseSync.cs new file mode 100644 index 0000000..9d9bd5a --- /dev/null +++ b/code/api/src/Endpoints/Internal/RouteBaseSync.cs @@ -0,0 +1,53 @@ +namespace IOL.GreatOffice.Api.Endpoints.Internal; + +/// <summary> +/// A base class for an endpoint that accepts parameters. +/// </summary> +public static class RouteBaseSync +{ + public static class WithRequest<TRequest> + { + public abstract class WithResult<TResponse> : INT_EndpointBase + { + public abstract TResponse Handle(TRequest request); + } + + public abstract class WithoutResult : INT_EndpointBase + { + public abstract void Handle(TRequest request); + } + + public abstract class WithActionResult<TResponse> : INT_EndpointBase + { + public abstract ActionResult<TResponse> Handle(TRequest request); + } + + public abstract class WithActionResult : INT_EndpointBase + { + public abstract ActionResult Handle(TRequest request); + } + } + + public static class WithoutRequest + { + public abstract class WithResult<TResponse> : INT_EndpointBase + { + public abstract TResponse Handle(); + } + + public abstract class WithoutResult : INT_EndpointBase + { + public abstract void Handle(); + } + + public abstract class WithActionResult<TResponse> : INT_EndpointBase + { + public abstract ActionResult<TResponse> Handle(); + } + + public abstract class WithActionResult : INT_EndpointBase + { + public abstract ActionResult Handle(); + } + } +} diff --git a/code/api/src/Endpoints/V1/ApiSpecV1.cs b/code/api/src/Endpoints/V1/ApiSpecV1.cs new file mode 100644 index 0000000..e4f9cc9 --- /dev/null +++ b/code/api/src/Endpoints/V1/ApiSpecV1.cs @@ -0,0 +1,18 @@ +namespace IOL.GreatOffice.Api.Endpoints.V1; + +public static class ApiSpecV1 +{ + private const int MAJOR = 1; + private const int MINOR = 0; + public const string VERSION_STRING = "1.0"; + + public static ApiSpecDocument Document => new() { + Version = new ApiVersion(MAJOR, MINOR), + VersionName = VERSION_STRING, + SwaggerPath = $"/swagger/{VERSION_STRING}/swagger.json", + OpenApiInfo = new OpenApiInfo { + Title = AppConstants.API_NAME, + Version = VERSION_STRING + } + }; +} diff --git a/code/api/src/Endpoints/V1/ApiTokens/CreateTokenRoute.cs b/code/api/src/Endpoints/V1/ApiTokens/CreateTokenRoute.cs new file mode 100644 index 0000000..163ddb6 --- /dev/null +++ b/code/api/src/Endpoints/V1/ApiTokens/CreateTokenRoute.cs @@ -0,0 +1,58 @@ +using System.Text; + +namespace IOL.GreatOffice.Api.Endpoints.V1.ApiTokens; + +public class CreateTokenRoute : RouteBaseSync.WithRequest<CreateTokenRoute.Payload>.WithActionResult +{ + private readonly MainAppDatabase _database; + private readonly AppConfiguration _configuration; + private readonly ILogger<CreateTokenRoute> _logger; + + public CreateTokenRoute(MainAppDatabase database, VaultService vaultService, ILogger<CreateTokenRoute> logger) { + _database = database; + _configuration = vaultService.GetCurrentAppConfiguration(); + _logger = logger; + } + + public class Payload + { + public DateTime ExpiryDate { get; set; } + public bool AllowRead { get; set; } + public bool AllowCreate { get; set; } + public bool AllowUpdate { get; set; } + public bool AllowDelete { get; set; } + } + + /// <summary> + /// Create a new api token with the provided claims. + /// </summary> + /// <param name="request">The claims to set on the api token</param> + /// <returns></returns> + [ApiVersion(ApiSpecV1.VERSION_STRING)] + [HttpPost("~/v{version:apiVersion}/api-tokens/create")] + public override ActionResult Handle(Payload request) { + var user = _database.Users.SingleOrDefault(c => c.Id == LoggedInUser.Id); + if (user == default) { + return NotFound(new KnownProblemModel("User does not exist")); + } + + var token_entropy = _configuration.APP_AES_KEY; + if (token_entropy.IsNullOrWhiteSpace()) { + _logger.LogWarning("No token entropy is available, Basic auth is disabled"); + return NotFound(); + } + + var accessToken = new ApiAccessToken() { + User = user, + ExpiryDate = request.ExpiryDate.ToUniversalTime(), + AllowCreate = request.AllowCreate, + AllowRead = request.AllowRead, + AllowDelete = request.AllowDelete, + AllowUpdate = request.AllowUpdate + }; + + _database.AccessTokens.Add(accessToken); + _database.SaveChanges(); + return Ok(Convert.ToBase64String(Encoding.UTF8.GetBytes(accessToken.Id.ToString().EncryptWithAes(token_entropy)))); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/V1/ApiTokens/DeleteTokenRoute.cs b/code/api/src/Endpoints/V1/ApiTokens/DeleteTokenRoute.cs new file mode 100644 index 0000000..ee19e40 --- /dev/null +++ b/code/api/src/Endpoints/V1/ApiTokens/DeleteTokenRoute.cs @@ -0,0 +1,31 @@ +namespace IOL.GreatOffice.Api.Endpoints.V1.ApiTokens; + +public class DeleteTokenRoute : RouteBaseSync.WithRequest<Guid>.WithActionResult +{ + private readonly MainAppDatabase _database; + private readonly ILogger<DeleteTokenRoute> _logger; + + public DeleteTokenRoute(MainAppDatabase database, ILogger<DeleteTokenRoute> logger) { + _database = database; + _logger = logger; + } + + /// <summary> + /// Delete an api token, rendering it unusable + /// </summary> + /// <param name="id">Id of the token to delete</param> + /// <returns>Nothing</returns> + [ApiVersion(ApiSpecV1.VERSION_STRING)] + [HttpDelete("~/v{version:apiVersion}/api-tokens/delete")] + public override ActionResult Handle(Guid id) { + var token = _database.AccessTokens.SingleOrDefault(c => c.Id == id); + if (token == default) { + _logger.LogWarning("A deletion request of an already deleted (maybe) api token was received."); + return NotFound(); + } + + _database.AccessTokens.Remove(token); + _database.SaveChanges(); + return Ok(); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/V1/ApiTokens/GetTokensRoute.cs b/code/api/src/Endpoints/V1/ApiTokens/GetTokensRoute.cs new file mode 100644 index 0000000..ee46b34 --- /dev/null +++ b/code/api/src/Endpoints/V1/ApiTokens/GetTokensRoute.cs @@ -0,0 +1,36 @@ +namespace IOL.GreatOffice.Api.Endpoints.V1.ApiTokens; + +public class GetTokensRoute : RouteBaseSync.WithoutRequest.WithResult<ActionResult<List<GetTokensRoute.ResponseModel>>> +{ + private readonly MainAppDatabase _database; + + public GetTokensRoute(MainAppDatabase database) { + _database = database; + } + + public class ResponseModel + { + public DateTime ExpiryDate { get; set; } + public bool AllowRead { get; set; } + public bool AllowCreate { get; set; } + public bool AllowUpdate { get; set; } + public bool AllowDelete { get; set; } + public bool HasExpired => ExpiryDate < AppDateTime.UtcNow; + } + + /// <summary> + /// Get all tokens, both active and inactive. + /// </summary> + /// <returns>A list of tokens</returns> + [ApiVersion(ApiSpecV1.VERSION_STRING)] + [HttpGet("~/v{version:apiVersion}/api-tokens")] + public override ActionResult<List<ResponseModel>> Handle() { + return Ok(_database.AccessTokens.Where(c => c.User.Id == LoggedInUser.Id).Select(c => new ResponseModel() { + AllowCreate = c.AllowCreate, + AllowRead = c.AllowRead, + AllowDelete = c.AllowDelete, + AllowUpdate = c.AllowUpdate, + ExpiryDate = c.ExpiryDate + })); + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/V1/Customers/CreateCustomerRoute.cs b/code/api/src/Endpoints/V1/Customers/CreateCustomerRoute.cs new file mode 100644 index 0000000..e58aa37 --- /dev/null +++ b/code/api/src/Endpoints/V1/Customers/CreateCustomerRoute.cs @@ -0,0 +1,66 @@ +namespace IOL.GreatOffice.Api.Endpoints.V1.Customers; + +public class CreateCustomerRoute : RouteBaseAsync.WithRequest<CreateCustomerPayload>.WithActionResult +{ + private readonly MainAppDatabase _database; + private readonly ILogger<CreateCustomerRoute> _logger; + private readonly IStringLocalizer<SharedResources> _localizer; + + public CreateCustomerRoute(MainAppDatabase database, ILogger<CreateCustomerRoute> logger, IStringLocalizer<SharedResources> localizer) { + _database = database; + _logger = logger; + _localizer = localizer; + } + + [HttpPost("~/v{version:apiVersion}/customers/create")] + public override async Task<ActionResult> HandleAsync(CreateCustomerPayload request, CancellationToken cancellationToken = default) { + var problem = new KnownProblemModel(); + if (request.Name.Trim().IsNullOrEmpty()) problem.AddError("name", _localizer["Name is a required field"]); + if (problem.Errors.Any()) { + problem.Title = _localizer["Invalid form"]; + problem.Subtitle = _localizer["One or more validation errors occured"]; + return KnownProblem(problem); + } + + var customer = new Customer(LoggedInUser) { + CustomerNumber = request.CustomerNumber, + Name = request.Name, + Description = request.Description, + Address1 = request.Address1, + Address2 = request.Address2, + Country = request.Country, + Currency = request.Currency, + Email = request.Email, + Phone = request.Phone, + PostalCity = request.PostalCity, + PostalCode = request.PostalCode, + VATNumber = request.VATNumber, + ORGNumber = request.ORGNumber, + DefaultReference = request.DefaultReference, + Website = request.Website + }; + customer.SetOwnerIds(default, LoggedInUser.TenantId); + _database.Customers.Add(customer); + await _database.SaveChangesAsync(cancellationToken); + return Ok(); + } +} + +public class CreateCustomerPayload +{ + public string CustomerNumber { get; set; } + public string Name { get; set; } + public string Description { get; set; } + public string Address1 { get; set; } + public string Address2 { get; set; } + public string PostalCode { get; set; } + public string PostalCity { get; set; } + public string Country { get; set; } + public string Phone { get; set; } + public string Email { get; set; } + public string VATNumber { get; set; } + public string ORGNumber { get; set; } + public string DefaultReference { get; set; } + public string Website { get; set; } + public string Currency { get; set; } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/V1/Projects/CreateProjectRoute.cs b/code/api/src/Endpoints/V1/Projects/CreateProjectRoute.cs new file mode 100644 index 0000000..bd37faf --- /dev/null +++ b/code/api/src/Endpoints/V1/Projects/CreateProjectRoute.cs @@ -0,0 +1,83 @@ +namespace IOL.GreatOffice.Api.Endpoints.V1.Projects; + +public class CreateProjectRoute : RouteBaseAsync.WithRequest<CreateProjectPayload>.WithActionResult +{ + private readonly MainAppDatabase _database; + private readonly IStringLocalizer<SharedResources> _localizer; + + public CreateProjectRoute(MainAppDatabase database, IStringLocalizer<SharedResources> localizer) { + _database = database; + _localizer = localizer; + } + + [HttpPost("~/v{version:apiVersion}/projects/create")] + public override async Task<ActionResult> HandleAsync(CreateProjectPayload request, CancellationToken cancellationToken = default) { + var problem = new KnownProblemModel(); + + if (request.Name.IsNullOrEmpty()) { + problem.AddError("name", _localizer["Name is a required field"]); + } + + var project = new Project(LoggedInUser) { + Name = request.Name, + Description = request.Description, + Start = request.Start, + Stop = request.Stop, + }; + + project.SetOwnerIds(default, LoggedInUser.TenantId); + + foreach (var customerId in request.CustomerIds) { + var customer = _database.Customers.FirstOrDefault(c => c.Id == customerId); + if (customer == default) { + problem.AddError("customer_" + customerId, _localizer["Customer not found"]); + continue; + } + + project.Customers.Add(customer); + } + + foreach (var member in request.Members) { + var user = _database.Users.FirstOrDefault(c => c.Id == member.UserId); + if (user == default) { + problem.AddError("members_" + member.UserId, _localizer["User not found"]); + continue; + } + + project.Members.Add(new ProjectMember() { + Project = project, + User = user, + Role = member.Role + }); + } + + if (problem.Errors.Any()) { + problem.Title = _localizer["Invalid form"]; + problem.Subtitle = _localizer["One or more validation errors occured"]; + return KnownProblem(problem); + } + + _database.Projects.Add(project); + await _database.SaveChangesAsync(cancellationToken); + return Ok(); + } +} + +public class CreateProjectResponse +{ } + +public class CreateProjectPayload +{ + public string Name { get; set; } + public string Description { get; set; } + public DateTime Start { get; set; } + public DateTime Stop { get; set; } + public List<Guid> CustomerIds { get; set; } + public List<ProjectMember> Members { get; set; } + + public class ProjectMember + { + public Guid UserId { get; set; } + public ProjectRole Role { get; set; } + } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/V1/Projects/GetProjectsRoute.cs b/code/api/src/Endpoints/V1/Projects/GetProjectsRoute.cs new file mode 100644 index 0000000..8fe70a6 --- /dev/null +++ b/code/api/src/Endpoints/V1/Projects/GetProjectsRoute.cs @@ -0,0 +1,40 @@ +using MR.AspNetCore.Pagination; + +namespace IOL.GreatOffice.Api.Endpoints.V1.Projects; + +public class GetProjectsRoute : RouteBaseAsync.WithRequest<GetProjectsQueryParameters>.WithActionResult<KeysetPaginationResult<GetProjectsResponseDto>> +{ + private readonly MainAppDatabase _database; + private readonly PaginationService _pagination; + + public GetProjectsRoute(MainAppDatabase database, PaginationService pagination) { + _database = database; + _pagination = pagination; + } + + [HttpGet("~/v{version:apiVersion}/projects")] + public override async Task<ActionResult<KeysetPaginationResult<GetProjectsResponseDto>>> HandleAsync([FromQuery] GetProjectsQueryParameters request, CancellationToken cancellationToken = default) { + var result = await _pagination.KeysetPaginateAsync( + _database.Projects.ForTenant(LoggedInUser).ConditionalWhere(() => request.NameQuery.HasValue(), p => p.Name.Contains(request.NameQuery)), + b => b.Descending(x => x.CreatedAt), + async id => await _database.Projects.FindAsync(id), + query => query.Select(p => new GetProjectsResponseDto() { + Id = p.Id, + Name = p.Name + }) + ); + return Ok(result); + } +} + +public class GetProjectsResponseDto +{ + public Guid Id { get; set; } + public string Name { get; set; } +} + +public class GetProjectsQueryParameters +{ + [FromQuery(Name = "name")] + public string NameQuery { get; set; } +}
\ No newline at end of file diff --git a/code/api/src/Endpoints/V1/Projects/_calls.http b/code/api/src/Endpoints/V1/Projects/_calls.http new file mode 100644 index 0000000..af0eba6 --- /dev/null +++ b/code/api/src/Endpoints/V1/Projects/_calls.http @@ -0,0 +1,12 @@ +### Create Project +GET https://localhost:5001/v1/projects/create +Accept: application/json +Content-Type: application/json +Cookie: "" + +{ + "": "" +} + +### Get Projects +POST http://localhost diff --git a/code/api/src/Endpoints/V1/RouteBaseAsync.cs b/code/api/src/Endpoints/V1/RouteBaseAsync.cs new file mode 100644 index 0000000..33b6f5f --- /dev/null +++ b/code/api/src/Endpoints/V1/RouteBaseAsync.cs @@ -0,0 +1,73 @@ +namespace IOL.GreatOffice.Api.Endpoints.V1; + +/// <summary> +/// A base class for an endpoint that accepts parameters. +/// </summary> +public class RouteBaseAsync +{ + public class WithRequest<TRequest> + { + public abstract class WithResult<TResponse> : V1_EndpointBase + { + public abstract Task<TResponse> HandleAsync( + TRequest request, + CancellationToken cancellationToken = default + ); + } + + public abstract class WithoutResult : V1_EndpointBase + { + public abstract Task HandleAsync( + TRequest request, + CancellationToken cancellationToken = default + ); + } + + public abstract class WithActionResult<TResponse> : V1_EndpointBase + { + public abstract Task<ActionResult<TResponse>> HandleAsync( + TRequest request, + CancellationToken cancellationToken = default + ); + } + + public abstract class WithActionResult : V1_EndpointBase + { + public abstract Task<ActionResult> HandleAsync( + TRequest request, + CancellationToken cancellationToken = default + ); + } + } + + public static class WithoutRequest + { + public abstract class WithResult<TResponse> : V1_EndpointBase + { + public abstract Task<TResponse> HandleAsync( + CancellationToken cancellationToken = default + ); + } + + public abstract class WithoutResult : V1_EndpointBase + { + public abstract Task HandleAsync( + CancellationToken cancellationToken = default + ); + } + + public abstract class WithActionResult<TResponse> : V1_EndpointBase + { + public abstract Task<ActionResult<TResponse>> HandleAsync( + CancellationToken cancellationToken = default + ); + } + + public abstract class WithActionResult : V1_EndpointBase + { + public abstract Task<ActionResult> HandleAsync( + CancellationToken cancellationToken = default + ); + } + } +} diff --git a/code/api/src/Endpoints/V1/RouteBaseSync.cs b/code/api/src/Endpoints/V1/RouteBaseSync.cs new file mode 100644 index 0000000..6a86074 --- /dev/null +++ b/code/api/src/Endpoints/V1/RouteBaseSync.cs @@ -0,0 +1,53 @@ +namespace IOL.GreatOffice.Api.Endpoints.V1; + +/// <summary> +/// A base class for an endpoint that accepts parameters. +/// </summary> +public static class RouteBaseSync +{ + public static class WithRequest<TRequest> + { + public abstract class WithResult<TResponse> : V1_EndpointBase + { + public abstract TResponse Handle(TRequest request); + } + + public abstract class WithoutResult : V1_EndpointBase + { + public abstract void Handle(TRequest request); + } + + public abstract class WithActionResult<TResponse> : V1_EndpointBase + { + public abstract ActionResult<TResponse> Handle(TRequest request); + } + + public abstract class WithActionResult : V1_EndpointBase + { + public abstract ActionResult Handle(TRequest request); + } + } + + public static class WithoutRequest + { + public abstract class WithResult<TResponse> : V1_EndpointBase + { + public abstract TResponse Handle(); + } + + public abstract class WithoutResult : V1_EndpointBase + { + public abstract void Handle(); + } + + public abstract class WithActionResult<TResponse> : V1_EndpointBase + { + public abstract ActionResult<TResponse> Handle(); + } + + public abstract class WithActionResult : V1_EndpointBase + { + public abstract ActionResult Handle(); + } + } +} diff --git a/code/api/src/Endpoints/V1/V1_EndpointBase.cs b/code/api/src/Endpoints/V1/V1_EndpointBase.cs new file mode 100644 index 0000000..08ce4ab --- /dev/null +++ b/code/api/src/Endpoints/V1/V1_EndpointBase.cs @@ -0,0 +1,29 @@ +using System.Net.Http.Headers; + +namespace IOL.GreatOffice.Api.Endpoints.V1; + +[ApiVersion(ApiSpecV1.VERSION_STRING)] +[Authorize(AuthenticationSchemes = AuthSchemes)] +public class V1_EndpointBase : EndpointBase +{ + private const string AuthSchemes = CookieAuthenticationDefaults.AuthenticationScheme + "," + AppConstants.BASIC_AUTH_SCHEME; + + protected bool IsApiCall() { + if (!Request.Headers.ContainsKey("Authorization")) return false; + try { + var authHeader = AuthenticationHeaderValue.Parse(Request.Headers["Authorization"]); + if (authHeader.Parameter == null) return false; + } catch { + return false; + } + + return true; + } + + protected bool HasApiPermission(string permission_key) { + var permission_claim = User.Claims.SingleOrDefault(c => c.Type == permission_key); + return permission_claim is { + Value: "True" + }; + } +}
\ No newline at end of file |