diff --git a/docs/en/UI/Blazor/Authorization.md b/docs/en/UI/Blazor/Authorization.md new file mode 100644 index 0000000000..7325c8e57b --- /dev/null +++ b/docs/en/UI/Blazor/Authorization.md @@ -0,0 +1,75 @@ +# Blazor UI: Authorization + +Blazor applications can use the same authorization system and permissions defined in the server side. + +> This document is only for authorizing on the Blazor UI. See the [Server Side Authorization](../../Authorization.md) to learn how to define permissions and control the authorization system. + +## Basic Usage + +> ABP Framework is **100% compatible** with the Authorization infrastructure provided by the Blazor. See the [Blazor Security Document](https://docs.microsoft.com/en-us/aspnet/core/blazor/security/) to learn all authorization options. This section **only shows some common scenarios**. + +### Authorize Attribute + +`[Authorize]` attribute can be used to show a page only to the authenticated users. + +````csharp +@page "/" +@attribute [Authorize] + +You can only see this if you're signed in. +```` + +The `[Authorize]` attribute also supports role-based or policy-based authorization. For example, you can check permissions defined in the server side: + +````csharp +@page "/" +@attribute [Authorize("MyPermission")] + +You can only see this if you have the necessary permission. +```` + +### AuthorizeView + +`AuthorizeView` component can be used in a page/component to conditionally render a part of the content: + +````html + +

You can only see this if you satisfy the "MyPermission" policy.

+
+```` + +### IAuthorizationService + +`IAuthorizationService` can be injected and used to programmatically check permissions: + +````csharp +public partial class Index +{ + protected override async Task OnInitializedAsync() + { + if (await AuthorizationService.IsGrantedAsync("MyPermission")) + { + //... + } + } +} +```` + +If your component directly or indirectly inherits from the `AbpComponentBase`, `AuthorizationService` becomes pre-injected and ready to use. If not, you can always [inject](../../Dependency-Injection.md) the `IAuthorizationService` yourself. + +`IAuthorizationService` can also be used in the view side where `AuthorizeView` component is not enough. + +There are some useful extension methods for the `IAuthorizationService`: + +* `IsGrantedAsync` simply returns `true` or `false` for the given policy/permission. +* `CheckAsync` checks and throws `AbpAuthorizationException` if given policy/permission hasn't granted. You don't have to handle these kind of exceptions since ABP Framework automatically [handles errors](Error-Handling.md). +* `AuthorizeAsync` returns `AuthorizationResult` as the standard way provided by the ASP.NET Core authorization system. + +> See the [Blazor Security Document](https://docs.microsoft.com/en-us/aspnet/core/blazor/security/) to learn all authorization options + +## See Also + +* [Authorization](../../Authorization.md) (server side) +* [Blazor Security](https://docs.microsoft.com/en-us/aspnet/core/blazor/security/) (Microsoft documentation) +* [ICurrentUser Service](CurrentUser.md) +