From 44c9ef9166f64730cadd8ddf0a8921b7ecdcd4b9 Mon Sep 17 00:00:00 2001
From: gdlcf88 <47396430@qq.com>
Date: Sun, 20 Oct 2019 17:57:31 +0800
Subject: [PATCH] Complete some permission checks.

---
 .../Pages/Identity/Roles/Index.cshtml                     | 7 ++++++-
 .../Pages/TenantManagement/Tenants/Index.cshtml           | 7 ++++++-
 .../Pages/ProductManagement/Products/index.js             | 8 ++------
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Roles/Index.cshtml b/modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Roles/Index.cshtml
index d2758f05d4..6d2721079f 100644
--- a/modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Roles/Index.cshtml
+++ b/modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Roles/Index.cshtml
@@ -1,4 +1,5 @@
 @page
+@using Microsoft.AspNetCore.Authorization
 @using Microsoft.AspNetCore.Mvc.Localization
 @using Volo.Abp.AspNetCore.Mvc.UI.Layout
 @using Volo.Abp.Identity.Localization
@@ -6,6 +7,7 @@
 @using Volo.Abp.Identity.Web.Pages.Identity.Roles
 @model IndexModel
 @inject IHtmlLocalizer<IdentityResource> L
+@inject IAuthorizationService Authorization
 @inject IPageLayout PageLayout
 @{
     PageLayout.Content.Title = L["Roles"].Value;
@@ -30,7 +32,10 @@
                 <abp-card-title>@L["Roles"]</abp-card-title>
             </abp-column>
             <abp-column size-md="_6" class="text-right">
-                <abp-button button-type="Primary" name="CreateRole" text="@L["NewRole"].Value" icon="plus" />
+                @if (await Authorization.IsGrantedAsync(IdentityPermissions.Roles.Create))
+                {
+                    <abp-button button-type="Primary" name="CreateRole" text="@L["NewRole"].Value" icon="plus" />
+                }
             </abp-column>
         </abp-row>
     </abp-card-header>
diff --git a/modules/tenant-management/src/Volo.Abp.TenantManagement.Web/Pages/TenantManagement/Tenants/Index.cshtml b/modules/tenant-management/src/Volo.Abp.TenantManagement.Web/Pages/TenantManagement/Tenants/Index.cshtml
index b5db7642ba..d41f1c7b53 100644
--- a/modules/tenant-management/src/Volo.Abp.TenantManagement.Web/Pages/TenantManagement/Tenants/Index.cshtml
+++ b/modules/tenant-management/src/Volo.Abp.TenantManagement.Web/Pages/TenantManagement/Tenants/Index.cshtml
@@ -1,4 +1,5 @@
 @page
+@using Microsoft.AspNetCore.Authorization
 @using Microsoft.AspNetCore.Mvc.Localization
 @using Volo.Abp.AspNetCore.Mvc.UI.Layout
 @using Volo.Abp.TenantManagement.Localization
@@ -6,6 +7,7 @@
 @using Volo.Abp.TenantManagement.Web.Pages.TenantManagement.Tenants
 @model IndexModel
 @inject IHtmlLocalizer<AbpTenantManagementResource> L
+@inject IAuthorizationService Authorization
 @inject IPageLayout PageLayout
 @{
     PageLayout.Content.Title = L["Tenants"].Value;
@@ -26,7 +28,10 @@
                 <abp-card-title>@L["Tenants"]</abp-card-title>
             </abp-column>
             <abp-column size-md="_6" class="text-right">
-                <abp-button button-type="Primary" name="CreateTenant" icon="plus" text="@L["NewTenant"].Value" />
+                @if (await Authorization.IsGrantedAsync(TenantManagementPermissions.Tenants.Create))
+                {
+                    <abp-button button-type="Primary" name="CreateTenant" icon="plus" text="@L["NewTenant"].Value" />
+                }
             </abp-column>
         </abp-row>
     </abp-card-header>
diff --git a/samples/MicroserviceDemo/modules/product/src/ProductManagement.Web/Pages/ProductManagement/Products/index.js b/samples/MicroserviceDemo/modules/product/src/ProductManagement.Web/Pages/ProductManagement/Products/index.js
index 2359310a5e..78fec06ba9 100644
--- a/samples/MicroserviceDemo/modules/product/src/ProductManagement.Web/Pages/ProductManagement/Products/index.js
+++ b/samples/MicroserviceDemo/modules/product/src/ProductManagement.Web/Pages/ProductManagement/Products/index.js
@@ -20,9 +20,7 @@
                         [
                             {
                                 text: l('Edit'),
-                                visible: function () {
-                                    return true; //TODO: Check permission
-                                },
+                                visible: abp.auth.isGranted('ProductManagement.Product.Update'),
                                 action: function (data) {
                                     _editModal.open({
                                         productId: data.record.id
@@ -31,9 +29,7 @@
                             },
                             {
                                 text: l('Delete'),
-                                visible: function () {
-                                    return true; //TODO: Check permission
-                                },
+                                visible: abp.auth.isGranted('ProductManagement.Product.Delete'),
                                 confirmMessage: function (data) { return l('ProductDeletionWarningMessage'); },
                                 action: function (data) {
                                     productManagement.products