Add state check to permissions.

Resolve #8518

framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/AbpPermissionOptions.cs

@@ -8,10 +8,13 @@ namespace Volo.Abp.Authorization.Permissions
 
         public ITypeList<IPermissionValueProvider> ValueProviders { get; }
 
+        public ITypeList<IPermissionStateProvider> GlobalStateProviders { get; }
+
         public AbpPermissionOptions()
         {
             DefinitionProviders = new TypeList<IPermissionDefinitionProvider>();
             ValueProviders = new TypeList<IPermissionValueProvider>();
+            GlobalStateProviders = new TypeList<IPermissionStateProvider>();
         }
     }
 }

framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/IPermissionStateManager.cs

@@ -0,0 +1,9 @@
+using System.Threading.Tasks;
+
+namespace Volo.Abp.Authorization.Permissions
+{
+    public interface IPermissionStateManager
+    {
+        Task<bool> IsEnabledAsync(PermissionDefinition permission);
+    }
+}

framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/IPermissionStateProvider.cs

@@ -0,0 +1,9 @@
+using System.Threading.Tasks;
+
+namespace Volo.Abp.Authorization.Permissions
+{
+    public interface IPermissionStateProvider
+    {
+        Task<bool> IsEnabledAsync(PermissionStateContext context);
+    }
+}

framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionChecker.cs

@@ -15,17 +15,20 @@ namespace Volo.Abp.Authorization.Permissions
         protected ICurrentPrincipalAccessor PrincipalAccessor { get; }
         protected ICurrentTenant CurrentTenant { get; }
         protected IPermissionValueProviderManager PermissionValueProviderManager { get; }
+        protected IPermissionStateManager PermissionStateManager { get; }
 
         public PermissionChecker(
             ICurrentPrincipalAccessor principalAccessor,
             IPermissionDefinitionManager permissionDefinitionManager,
             ICurrentTenant currentTenant,
-            IPermissionValueProviderManager permissionValueProviderManager)
+            IPermissionValueProviderManager permissionValueProviderManager,
+            IPermissionStateManager permissionStateManager)
         {
             PrincipalAccessor = principalAccessor;
             PermissionDefinitionManager = permissionDefinitionManager;
             CurrentTenant = currentTenant;
             PermissionValueProviderManager = permissionValueProviderManager;
+            PermissionStateManager = permissionStateManager;
         }
 
         public virtual async Task<bool> IsGrantedAsync(string name)
@@ -46,6 +49,11 @@ namespace Volo.Abp.Authorization.Permissions
                 return false;
             }
 
+            if (!await PermissionStateManager.IsEnabledAsync(permission))
+            {
+                return false;
+            }
+
             var multiTenancySide = claimsPrincipal?.GetMultiTenancySide()
                                    ?? CurrentTenant.GetMultiTenancySide();
 
@@ -103,7 +111,9 @@ namespace Volo.Abp.Authorization.Permissions
 
                 result.Result.Add(name, PermissionGrantResult.Undefined);
 
-                if (permission.IsEnabled && permission.MultiTenancySide.HasFlag(multiTenancySide))
+                if (permission.IsEnabled &&
+                    await PermissionStateManager.IsEnabledAsync(permission) &&
+                    permission.MultiTenancySide.HasFlag(multiTenancySide))
                 {
                     permissionDefinitions.Add(permission);
                 }

framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionDefinitionExtensions.cs

@@ -0,0 +1,34 @@
+using System.Collections.Generic;
+using JetBrains.Annotations;
+
+namespace Volo.Abp.Authorization.Permissions
+{
+    public static class PermissionDefinitionExtensions
+    {
+        public const string PropertyName = "_AbpPermissionStateProviders";
+
+        public static PermissionDefinition AddStateProvider(
+            [NotNull] this PermissionDefinition permissionDefinition,
+            [NotNull] params IPermissionStateProvider[] permissionStateProviders)
+        {
+            var stateProviders = permissionDefinition.GetStateProvidersInternal();
+
+            foreach (var provider in permissionStateProviders)
+            {
+                stateProviders.AddIfNotContains(provider);
+            }
+
+            return permissionDefinition;
+        }
+
+        public static IReadOnlyList<IPermissionStateProvider> GetStateProviders([NotNull] this PermissionDefinition permissionDefinition)
+        {
+            return permissionDefinition.GetStateProvidersInternal();
+        }
+
+        private static List<IPermissionStateProvider> GetStateProvidersInternal([NotNull] this PermissionDefinition permissionDefinition)
+        {
+            return (List<IPermissionStateProvider>) permissionDefinition.Properties.GetOrAdd(PropertyName, () => new List<IPermissionStateProvider>());
+        }
+    }
+}

framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionStateContext.cs

@@ -0,0 +1,11 @@
+using System;
+
+namespace Volo.Abp.Authorization.Permissions
+{
+    public class PermissionStateContext
+    {
+        public IServiceProvider ServiceProvider { get; set; }
+
+        public PermissionDefinition Permission { get; set; }
+    }
+}

framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionStateManager.cs

@@ -0,0 +1,55 @@
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.Authorization.Permissions
+{
+    public class PermissionStateManager : IPermissionStateManager, ITransientDependency
+    {
+        protected IServiceProvider ServiceProvider { get; }
+        protected AbpPermissionOptions Options { get; }
+
+        public PermissionStateManager(IServiceProvider serviceProvider, IOptions<AbpPermissionOptions> options)
+        {
+            ServiceProvider = serviceProvider;
+            Options = options.Value;
+        }
+
+        public async Task<bool> IsEnabledAsync(PermissionDefinition permission)
+        {
+            using (var scope = ServiceProvider.CreateScope())
+            {
+                var context = new PermissionStateContext
+                {
+                    Permission = permission,
+                    ServiceProvider = scope.ServiceProvider
+                };
+
+                var providers = permission.GetStateProviders();
+                if (providers != null && providers.Any())
+                {
+                    foreach (var provider in providers)
+                    {
+                        if (!await provider.IsEnabledAsync(context))
+                        {
+                            return false;
+                        }
+                    }
+                }
+
+                foreach (IPermissionStateProvider provider in Options.GlobalStateProviders.Select(x => ServiceProvider.GetRequiredService(x)))
+                {
+                    if (!await provider.IsEnabledAsync(context))
+                    {
+                        return false;
+                    }
+                }
+
+                return true;
+            }
+        }
+    }
+}

framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/PermissionStateProvider_Tests.cs

@@ -0,0 +1,63 @@
+using System;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+using Volo.Abp.Authorization.Permissions;
+using Volo.Abp.Security.Claims;
+using Xunit;
+
+namespace Volo.Abp.Authorization
+{
+    public abstract class PermissionStateProvider_Tests : AuthorizationTestBase
+    {
+        protected IPermissionStateManager PermissionStateManager { get; }
+        protected IPermissionDefinitionManager PermissionDefinitionManager { get; }
+        protected ICurrentPrincipalAccessor CurrentPrincipalAccessor { get; }
+
+        public PermissionStateProvider_Tests()
+        {
+            PermissionStateManager = GetRequiredService<IPermissionStateManager>();
+            PermissionDefinitionManager = GetRequiredService<IPermissionDefinitionManager>();
+            CurrentPrincipalAccessor = GetRequiredService<ICurrentPrincipalAccessor>();
+        }
+    }
+
+    public class SpecifyPermissionStateProvider : PermissionStateProvider_Tests
+    {
+        [Fact]
+        public async Task PermissionState_Test()
+        {
+            var myPermission1 = PermissionDefinitionManager.Get("MyPermission1");
+            myPermission1.GetStateProviders().ShouldContain(x => x.GetType() == typeof(TestRequireEditionPermissionStateProvider));
+
+            (await PermissionStateManager.IsEnabledAsync(myPermission1)).ShouldBeFalse();
+
+            using (CurrentPrincipalAccessor.Change(new Claim(AbpClaimTypes.EditionId, Guid.NewGuid().ToString())))
+            {
+                (await PermissionStateManager.IsEnabledAsync(myPermission1)).ShouldBeTrue();
+            }
+        }
+    }
+
+    public class GlobalPermissionStateProvider : PermissionStateProvider_Tests
+    {
+        protected override void AfterAddApplication(IServiceCollection services)
+        {
+            services.Configure<AbpPermissionOptions>(options => options.GlobalStateProviders.Add<TestGlobalRequireRolePermissionStateProvider>());
+        }
+
+        [Fact]
+        public async Task Global_PermissionState_Test()
+        {
+            var myPermission2 = PermissionDefinitionManager.Get("MyPermission2");
+
+            (await PermissionStateManager.IsEnabledAsync(myPermission2)).ShouldBeFalse();
+
+            using (CurrentPrincipalAccessor.Change(new Claim(AbpClaimTypes.Role, "admin")))
+            {
+                (await PermissionStateManager.IsEnabledAsync(myPermission2)).ShouldBeTrue();
+            }
+        }
+    }
+}

framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestGlobalRequireRolePermissionStateProvider.cs

@@ -0,0 +1,17 @@
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using Volo.Abp.Authorization.Permissions;
+using Volo.Abp.DependencyInjection;
+using Volo.Abp.Security.Claims;
+
+namespace Volo.Abp.Authorization
+{
+    public class TestGlobalRequireRolePermissionStateProvider : IPermissionStateProvider, ITransientDependency
+    {
+        public Task<bool> IsEnabledAsync(PermissionStateContext context)
+        {
+            var currentPrincipalAccessor = context.ServiceProvider.GetRequiredService<ICurrentPrincipalAccessor>();
+            return Task.FromResult(currentPrincipalAccessor.Principal != null && currentPrincipalAccessor.Principal.IsInRole("admin"));
+        }
+    }
+}

framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestRequireEditionPermissionStateProvider.cs

@@ -0,0 +1,17 @@
+using System.Security.Principal;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using Volo.Abp.Authorization.Permissions;
+using Volo.Abp.Security.Claims;
+
+namespace Volo.Abp.Authorization
+{
+    public class TestRequireEditionPermissionStateProvider : IPermissionStateProvider
+    {
+        public Task<bool> IsEnabledAsync(PermissionStateContext context)
+        {
+            var currentPrincipalAccessor = context.ServiceProvider.GetRequiredService<ICurrentPrincipalAccessor>();
+            return Task.FromResult(currentPrincipalAccessor.Principal?.FindEditionId() != null);
+        }
+    }
+}

framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestServices/AuthorizationTestPermissionDefinitionProvider.cs

@@ -12,11 +12,14 @@ namespace Volo.Abp.Authorization.TestServices
             {
                 getGroup = context.AddGroup("TestGetGroup");
             }
-            
+
             var group = context.AddGroup("TestGroup");
 
             group.AddPermission("MyAuthorizedService1");
 
+            group.AddPermission("MyPermission1").AddStateProvider(new TestRequireEditionPermissionStateProvider());
+            group.AddPermission("MyPermission2");
+
             group.GetPermissionOrNull("MyAuthorizedService1").ShouldNotBeNull();
 
             context.RemoveGroup("TestGetGroup");

modules/permission-management/src/Volo.Abp.PermissionManagement.Application/Volo/Abp/PermissionManagement/PermissionAppService.cs

@@ -14,18 +14,20 @@ namespace Volo.Abp.PermissionManagement
     public class PermissionAppService : ApplicationService, IPermissionAppService
     {
         protected PermissionManagementOptions Options { get; }
-
         protected IPermissionManager PermissionManager { get; }
         protected IPermissionDefinitionManager PermissionDefinitionManager { get; }
+        protected IPermissionStateManager PermissionStateManager { get; }
 
         public PermissionAppService(
-            IPermissionManager permissionManager, 
+            IPermissionManager permissionManager,
             IPermissionDefinitionManager permissionDefinitionManager,
-            IOptions<PermissionManagementOptions> options)
+            IOptions<PermissionManagementOptions> options,
+            IPermissionStateManager permissionStateManager)
         {
             Options = options.Value;
             PermissionManager = permissionManager;
             PermissionDefinitionManager = permissionDefinitionManager;
+            PermissionStateManager = permissionStateManager;
         }
 
         public virtual async Task<GetPermissionListResultDto> GetAsync(string providerName, string providerKey)
@@ -56,6 +58,11 @@ namespace Volo.Abp.PermissionManagement
                         continue;
                     }
 
+                    if (!await PermissionStateManager.IsEnabledAsync(permission))
+                    {
+                        continue;
+                    }
+
                     if (permission.Providers.Any() && !permission.Providers.Contains(providerName))
                     {
                         continue;

modules/permission-management/src/Volo.Abp.PermissionManagement.Domain/Volo/Abp/PermissionManagement/PermissionManager.cs

@@ -18,6 +18,8 @@ namespace Volo.Abp.PermissionManagement
 
         protected IPermissionDefinitionManager PermissionDefinitionManager { get; }
 
+        protected IPermissionStateManager PermissionStateManager { get; }
+
         protected IGuidGenerator GuidGenerator { get; }
 
         protected ICurrentTenant CurrentTenant { get; }
@@ -25,23 +27,25 @@ namespace Volo.Abp.PermissionManagement
         protected IReadOnlyList<IPermissionManagementProvider> ManagementProviders => _lazyProviders.Value;
 
         protected PermissionManagementOptions Options { get; }
-        
+
         protected IDistributedCache<PermissionGrantCacheItem> Cache { get; }
 
         private readonly Lazy<List<IPermissionManagementProvider>> _lazyProviders;
 
         public PermissionManager(
             IPermissionDefinitionManager permissionDefinitionManager,
+            IPermissionStateManager permissionStateManager,
             IPermissionGrantRepository permissionGrantRepository,
             IServiceProvider serviceProvider,
             IGuidGenerator guidGenerator,
             IOptions<PermissionManagementOptions> options,
-            ICurrentTenant currentTenant, 
+            ICurrentTenant currentTenant,
             IDistributedCache<PermissionGrantCacheItem> cache)
         {
             GuidGenerator = guidGenerator;
             CurrentTenant = currentTenant;
             Cache = cache;
+            PermissionStateManager = permissionStateManager;
             PermissionGrantRepository = permissionGrantRepository;
             PermissionDefinitionManager = permissionDefinitionManager;
             Options = options.Value;
@@ -76,7 +80,7 @@ namespace Volo.Abp.PermissionManagement
         {
             var permission = PermissionDefinitionManager.Get(permissionName);
 
-            if (!permission.IsEnabled)
+            if (!permission.IsEnabled || !await PermissionStateManager.IsEnabledAsync(permission))
             {
                 //TODO: BusinessException
                 throw new ApplicationException($"The permission named '{permission.Name}' is disabled!");
@@ -109,7 +113,7 @@ namespace Volo.Abp.PermissionManagement
 
             await provider.SetAsync(permissionName, providerKey, isGranted);
         }
-        
+
         public virtual async Task<PermissionGrant> UpdateProviderKeyAsync(PermissionGrant permissionGrant, string providerKey)
         {
             using (CurrentTenant.Change(permissionGrant.TenantId))
@@ -123,7 +127,7 @@ namespace Volo.Abp.PermissionManagement
                     )
                 );
             }
-            
+
             permissionGrant.ProviderKey = providerKey;
             return await PermissionGrantRepository.UpdateAsync(permissionGrant);
         }
@@ -146,6 +150,11 @@ namespace Volo.Abp.PermissionManagement
                 return result;
             }
 
+            if (!await PermissionStateManager.IsEnabledAsync(permission))
+            {
+                return result;
+            }
+
             if (!permission.MultiTenancySide.HasFlag(CurrentTenant.GetMultiTenancySide()))
             {
                 return result;

modules/permission-management/test/Volo.Abp.PermissionManagement.Application.Tests/Volo/Abp/PermissionManagement/AbpPermissionManagementApplicationTestBase.cs

@@ -18,7 +18,7 @@ namespace Volo.Abp.PermissionManagement
         protected override void AfterAddApplication(IServiceCollection services)
         {
             var currentUser = Substitute.For<ICurrentUser>();
-            //currentUser.Id.Returns(ci => CurrentUserId);
+            currentUser.Roles.Returns(new []{ "admin" });
             currentUser.IsAuthenticated.Returns(true);
 
             services.AddSingleton(currentUser);

modules/permission-management/test/Volo.Abp.PermissionManagement.Application.Tests/Volo/Abp/PermissionManagement/PermissionAppService_Tests.cs

@@ -1,10 +1,12 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Security.Claims;
 using System.Text;
 using System.Threading.Tasks;
 using Shouldly;
 using Volo.Abp.Authorization.Permissions;
+using Volo.Abp.Security.Claims;
 using Xunit;
 
 namespace Volo.Abp.PermissionManagement.Application.Tests.Volo.Abp.PermissionManagement
@@ -13,11 +15,13 @@ namespace Volo.Abp.PermissionManagement.Application.Tests.Volo.Abp.PermissionMan
     {
         private readonly IPermissionAppService _permissionAppService;
         private readonly IPermissionGrantRepository _permissionGrantRepository;
+        private readonly ICurrentPrincipalAccessor _currentPrincipalAccessor;
 
         public PermissionAppService_Tests()
         {
             _permissionAppService = GetRequiredService<IPermissionAppService>();
             _permissionGrantRepository = GetRequiredService<IPermissionGrantRepository>();
+            _currentPrincipalAccessor = GetRequiredService<ICurrentPrincipalAccessor>();
         }
 
         [Fact]
@@ -35,7 +39,15 @@ namespace Volo.Abp.PermissionManagement.Application.Tests.Volo.Abp.PermissionMan
             permissionListResultDto.Groups.First().Permissions.ShouldContain(x => x.Name == "MyPermission2");
             permissionListResultDto.Groups.First().Permissions.ShouldContain(x => x.Name == "MyPermission2.ChildPermission1");
             permissionListResultDto.Groups.First().Permissions.ShouldContain(x => x.Name == "MyPermission3");
+            permissionListResultDto.Groups.First().Permissions.ShouldContain(x => x.Name == "MyPermission4");
 
+            permissionListResultDto.Groups.First().Permissions.ShouldNotContain(x => x.Name == "MyPermission5");
+
+            using (_currentPrincipalAccessor.Change(new Claim(AbpClaimTypes.Role, "super-admin")))
+            {
+                (await _permissionAppService.GetAsync(UserPermissionValueProvider.ProviderName, PermissionTestDataBuilder.User1Id.ToString())).Groups.First().Permissions
+                    .ShouldContain(x => x.Name == "MyPermission5");
+            }
         }
 
         [Fact]

modules/permission-management/test/Volo.Abp.PermissionManagement.Domain.Tests/Volo/Abp/PermissionManagement/PermissionChecker_User_Tests.cs

@@ -11,10 +11,12 @@ namespace Volo.Abp.PermissionManagement
     public class PermissionChecker_User_Tests : PermissionTestBase
     {
         private readonly IPermissionChecker _permissionChecker;
+        private readonly ICurrentPrincipalAccessor _currentPrincipalAccessor;
 
         public PermissionChecker_User_Tests()
         {
             _permissionChecker = GetRequiredService<IPermissionChecker>();
+            _currentPrincipalAccessor = GetRequiredService<ICurrentPrincipalAccessor>();
         }
 
         [Fact]
@@ -64,6 +66,27 @@ namespace Volo.Abp.PermissionManagement
             )).ShouldBeFalse();
         }
 
+        [Fact]
+        public async Task Should_Return_False_For_Granted_Current_User_If_The_Permission_State_Is_Disabled()
+        {
+            (await _permissionChecker.IsGrantedAsync(
+                CreatePrincipal(PermissionTestDataBuilder.User1Id, Guid.NewGuid()),
+                "MyPermission5"
+            )).ShouldBeFalse();
+        }
+
+        [Fact]
+        public async Task Should_Return_True_For_Granted_Current_User_If_The_Permission_State_Is_Enabled()
+        {
+            using (_currentPrincipalAccessor.Change(new Claim(AbpClaimTypes.Role, "super-admin")))
+            {
+                (await _permissionChecker.IsGrantedAsync(
+                    CreatePrincipal(PermissionTestDataBuilder.User1Id, Guid.NewGuid()),
+                    "MyPermission5"
+                )).ShouldBeTrue();
+            }
+        }
+
         private static ClaimsPrincipal CreatePrincipal(Guid? userId, Guid? tenantId = null)
         {
             var claimsIdentity = new ClaimsIdentity();

modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/PermissionTestDataBuilder.cs

@@ -48,6 +48,15 @@ namespace Volo.Abp.PermissionManagement
                     User1Id.ToString()
                 )
             );
+
+            await _permissionGrantRepository.InsertAsync(
+                new PermissionGrant(
+                    _guidGenerator.Create(),
+                    "MyPermission5",
+                    UserPermissionValueProvider.ProviderName,
+                    User1Id.ToString()
+                )
+            );
         }
     }
-}
+}

modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/TestPermissionDefinitionProvider.cs

@@ -18,6 +18,8 @@ namespace Volo.Abp.PermissionManagement
             testGroup.AddPermission("MyPermission3", multiTenancySide: MultiTenancySides.Host);
 
             testGroup.AddPermission("MyPermission4", multiTenancySide: MultiTenancySides.Host).WithProviders(UserPermissionValueProvider.ProviderName);
+
+            testGroup.AddPermission("MyPermission5").AddStateProvider(new TestRequireRolePermissionStateProvider("super-admin"));
         }
     }
 }

modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/TestRequireRolePermissionStateProvider.cs

@@ -0,0 +1,25 @@
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using Volo.Abp.Authorization.Permissions;
+using Volo.Abp.Security.Claims;
+
+namespace Volo.Abp.PermissionManagement
+{
+    public class TestRequireRolePermissionStateProvider : IPermissionStateProvider
+    {
+        private readonly List<string> _allowRoles = new List<string>();
+
+        public TestRequireRolePermissionStateProvider(params string[] roles)
+        {
+            _allowRoles.AddRange(roles);
+        }
+
+        public Task<bool> IsEnabledAsync(PermissionStateContext context)
+        {
+            var currentPrincipalAccessor = context.ServiceProvider.GetRequiredService<ICurrentPrincipalAccessor>();
+            return Task.FromResult(currentPrincipalAccessor.Principal != null && _allowRoles.Any(role => currentPrincipalAccessor.Principal.IsInRole(role)));
+        }
+    }
+}