diff --git a/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/AbpPermissionOptions.cs b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/AbpPermissionOptions.cs index ce9dc06798..eb2ac920ac 100644 --- a/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/AbpPermissionOptions.cs +++ b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/AbpPermissionOptions.cs @@ -8,10 +8,13 @@ namespace Volo.Abp.Authorization.Permissions public ITypeList ValueProviders { get; } + public ITypeList GlobalStateProviders { get; } + public AbpPermissionOptions() { DefinitionProviders = new TypeList(); ValueProviders = new TypeList(); + GlobalStateProviders = new TypeList(); } } } diff --git a/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/IPermissionStateManager.cs b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/IPermissionStateManager.cs new file mode 100644 index 0000000000..6195e02545 --- /dev/null +++ b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/IPermissionStateManager.cs @@ -0,0 +1,9 @@ +using System.Threading.Tasks; + +namespace Volo.Abp.Authorization.Permissions +{ + public interface IPermissionStateManager + { + Task IsEnabledAsync(PermissionDefinition permission); + } +} diff --git a/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/IPermissionStateProvider.cs b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/IPermissionStateProvider.cs new file mode 100644 index 0000000000..7bc3087f50 --- /dev/null +++ b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/IPermissionStateProvider.cs @@ -0,0 +1,9 @@ +using System.Threading.Tasks; + +namespace Volo.Abp.Authorization.Permissions +{ + public interface IPermissionStateProvider + { + Task IsEnabledAsync(PermissionStateContext context); + } +} diff --git a/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionChecker.cs b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionChecker.cs index bfdcf5fd66..f180a00bd7 100644 --- a/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionChecker.cs +++ b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionChecker.cs @@ -15,17 +15,20 @@ namespace Volo.Abp.Authorization.Permissions protected ICurrentPrincipalAccessor PrincipalAccessor { get; } protected ICurrentTenant CurrentTenant { get; } protected IPermissionValueProviderManager PermissionValueProviderManager { get; } + protected IPermissionStateManager PermissionStateManager { get; } public PermissionChecker( ICurrentPrincipalAccessor principalAccessor, IPermissionDefinitionManager permissionDefinitionManager, ICurrentTenant currentTenant, - IPermissionValueProviderManager permissionValueProviderManager) + IPermissionValueProviderManager permissionValueProviderManager, + IPermissionStateManager permissionStateManager) { PrincipalAccessor = principalAccessor; PermissionDefinitionManager = permissionDefinitionManager; CurrentTenant = currentTenant; PermissionValueProviderManager = permissionValueProviderManager; + PermissionStateManager = permissionStateManager; } public virtual async Task IsGrantedAsync(string name) @@ -46,6 +49,11 @@ namespace Volo.Abp.Authorization.Permissions return false; } + if (!await PermissionStateManager.IsEnabledAsync(permission)) + { + return false; + } + var multiTenancySide = claimsPrincipal?.GetMultiTenancySide() ?? CurrentTenant.GetMultiTenancySide(); @@ -103,7 +111,9 @@ namespace Volo.Abp.Authorization.Permissions result.Result.Add(name, PermissionGrantResult.Undefined); - if (permission.IsEnabled && permission.MultiTenancySide.HasFlag(multiTenancySide)) + if (permission.IsEnabled && + await PermissionStateManager.IsEnabledAsync(permission) && + permission.MultiTenancySide.HasFlag(multiTenancySide)) { permissionDefinitions.Add(permission); } diff --git a/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionDefinitionExtensions.cs b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionDefinitionExtensions.cs new file mode 100644 index 0000000000..34e0c4b68b --- /dev/null +++ b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionDefinitionExtensions.cs @@ -0,0 +1,34 @@ +using System.Collections.Generic; +using JetBrains.Annotations; + +namespace Volo.Abp.Authorization.Permissions +{ + public static class PermissionDefinitionExtensions + { + public const string PropertyName = "_AbpPermissionStateProviders"; + + public static PermissionDefinition AddStateProvider( + [NotNull] this PermissionDefinition permissionDefinition, + [NotNull] params IPermissionStateProvider[] permissionStateProviders) + { + var stateProviders = permissionDefinition.GetStateProvidersInternal(); + + foreach (var provider in permissionStateProviders) + { + stateProviders.AddIfNotContains(provider); + } + + return permissionDefinition; + } + + public static IReadOnlyList GetStateProviders([NotNull] this PermissionDefinition permissionDefinition) + { + return permissionDefinition.GetStateProvidersInternal(); + } + + private static List GetStateProvidersInternal([NotNull] this PermissionDefinition permissionDefinition) + { + return (List) permissionDefinition.Properties.GetOrAdd(PropertyName, () => new List()); + } + } +} diff --git a/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionStateContext.cs b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionStateContext.cs new file mode 100644 index 0000000000..565e0afe99 --- /dev/null +++ b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionStateContext.cs @@ -0,0 +1,11 @@ +using System; + +namespace Volo.Abp.Authorization.Permissions +{ + public class PermissionStateContext + { + public IServiceProvider ServiceProvider { get; set; } + + public PermissionDefinition Permission { get; set; } + } +} diff --git a/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionStateManager.cs b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionStateManager.cs new file mode 100644 index 0000000000..0729e57de3 --- /dev/null +++ b/framework/src/Volo.Abp.Authorization/Volo/Abp/Authorization/Permissions/PermissionStateManager.cs @@ -0,0 +1,55 @@ +using System; +using System.Linq; +using System.Threading.Tasks; +using Microsoft.Extensions.DependencyInjection; +using Microsoft.Extensions.Options; +using Volo.Abp.DependencyInjection; + +namespace Volo.Abp.Authorization.Permissions +{ + public class PermissionStateManager : IPermissionStateManager, ITransientDependency + { + protected IServiceProvider ServiceProvider { get; } + protected AbpPermissionOptions Options { get; } + + public PermissionStateManager(IServiceProvider serviceProvider, IOptions options) + { + ServiceProvider = serviceProvider; + Options = options.Value; + } + + public async Task IsEnabledAsync(PermissionDefinition permission) + { + using (var scope = ServiceProvider.CreateScope()) + { + var context = new PermissionStateContext + { + Permission = permission, + ServiceProvider = scope.ServiceProvider + }; + + var providers = permission.GetStateProviders(); + if (providers != null && providers.Any()) + { + foreach (var provider in providers) + { + if (!await provider.IsEnabledAsync(context)) + { + return false; + } + } + } + + foreach (IPermissionStateProvider provider in Options.GlobalStateProviders.Select(x => ServiceProvider.GetRequiredService(x))) + { + if (!await provider.IsEnabledAsync(context)) + { + return false; + } + } + + return true; + } + } + } +} diff --git a/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/PermissionStateProvider_Tests.cs b/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/PermissionStateProvider_Tests.cs new file mode 100644 index 0000000000..1ab609cd87 --- /dev/null +++ b/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/PermissionStateProvider_Tests.cs @@ -0,0 +1,63 @@ +using System; +using System.Security.Claims; +using System.Threading.Tasks; +using Microsoft.Extensions.DependencyInjection; +using Shouldly; +using Volo.Abp.Authorization.Permissions; +using Volo.Abp.Security.Claims; +using Xunit; + +namespace Volo.Abp.Authorization +{ + public abstract class PermissionStateProvider_Tests : AuthorizationTestBase + { + protected IPermissionStateManager PermissionStateManager { get; } + protected IPermissionDefinitionManager PermissionDefinitionManager { get; } + protected ICurrentPrincipalAccessor CurrentPrincipalAccessor { get; } + + public PermissionStateProvider_Tests() + { + PermissionStateManager = GetRequiredService(); + PermissionDefinitionManager = GetRequiredService(); + CurrentPrincipalAccessor = GetRequiredService(); + } + } + + public class SpecifyPermissionStateProvider : PermissionStateProvider_Tests + { + [Fact] + public async Task PermissionState_Test() + { + var myPermission1 = PermissionDefinitionManager.Get("MyPermission1"); + myPermission1.GetStateProviders().ShouldContain(x => x.GetType() == typeof(TestRequireEditionPermissionStateProvider)); + + (await PermissionStateManager.IsEnabledAsync(myPermission1)).ShouldBeFalse(); + + using (CurrentPrincipalAccessor.Change(new Claim(AbpClaimTypes.EditionId, Guid.NewGuid().ToString()))) + { + (await PermissionStateManager.IsEnabledAsync(myPermission1)).ShouldBeTrue(); + } + } + } + + public class GlobalPermissionStateProvider : PermissionStateProvider_Tests + { + protected override void AfterAddApplication(IServiceCollection services) + { + services.Configure(options => options.GlobalStateProviders.Add()); + } + + [Fact] + public async Task Global_PermissionState_Test() + { + var myPermission2 = PermissionDefinitionManager.Get("MyPermission2"); + + (await PermissionStateManager.IsEnabledAsync(myPermission2)).ShouldBeFalse(); + + using (CurrentPrincipalAccessor.Change(new Claim(AbpClaimTypes.Role, "admin"))) + { + (await PermissionStateManager.IsEnabledAsync(myPermission2)).ShouldBeTrue(); + } + } + } +} diff --git a/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestGlobalRequireRolePermissionStateProvider.cs b/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestGlobalRequireRolePermissionStateProvider.cs new file mode 100644 index 0000000000..6e3b58d2de --- /dev/null +++ b/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestGlobalRequireRolePermissionStateProvider.cs @@ -0,0 +1,17 @@ +using System.Threading.Tasks; +using Microsoft.Extensions.DependencyInjection; +using Volo.Abp.Authorization.Permissions; +using Volo.Abp.DependencyInjection; +using Volo.Abp.Security.Claims; + +namespace Volo.Abp.Authorization +{ + public class TestGlobalRequireRolePermissionStateProvider : IPermissionStateProvider, ITransientDependency + { + public Task IsEnabledAsync(PermissionStateContext context) + { + var currentPrincipalAccessor = context.ServiceProvider.GetRequiredService(); + return Task.FromResult(currentPrincipalAccessor.Principal != null && currentPrincipalAccessor.Principal.IsInRole("admin")); + } + } +} diff --git a/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestRequireEditionPermissionStateProvider.cs b/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestRequireEditionPermissionStateProvider.cs new file mode 100644 index 0000000000..a793c84431 --- /dev/null +++ b/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestRequireEditionPermissionStateProvider.cs @@ -0,0 +1,17 @@ +using System.Security.Principal; +using System.Threading.Tasks; +using Microsoft.Extensions.DependencyInjection; +using Volo.Abp.Authorization.Permissions; +using Volo.Abp.Security.Claims; + +namespace Volo.Abp.Authorization +{ + public class TestRequireEditionPermissionStateProvider : IPermissionStateProvider + { + public Task IsEnabledAsync(PermissionStateContext context) + { + var currentPrincipalAccessor = context.ServiceProvider.GetRequiredService(); + return Task.FromResult(currentPrincipalAccessor.Principal?.FindEditionId() != null); + } + } +} diff --git a/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestServices/AuthorizationTestPermissionDefinitionProvider.cs b/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestServices/AuthorizationTestPermissionDefinitionProvider.cs index 8cff4c361f..8198119a6d 100644 --- a/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestServices/AuthorizationTestPermissionDefinitionProvider.cs +++ b/framework/test/Volo.Abp.Authorization.Tests/Volo/Abp/Authorization/TestServices/AuthorizationTestPermissionDefinitionProvider.cs @@ -12,11 +12,14 @@ namespace Volo.Abp.Authorization.TestServices { getGroup = context.AddGroup("TestGetGroup"); } - + var group = context.AddGroup("TestGroup"); group.AddPermission("MyAuthorizedService1"); + group.AddPermission("MyPermission1").AddStateProvider(new TestRequireEditionPermissionStateProvider()); + group.AddPermission("MyPermission2"); + group.GetPermissionOrNull("MyAuthorizedService1").ShouldNotBeNull(); context.RemoveGroup("TestGetGroup"); diff --git a/modules/permission-management/src/Volo.Abp.PermissionManagement.Application/Volo/Abp/PermissionManagement/PermissionAppService.cs b/modules/permission-management/src/Volo.Abp.PermissionManagement.Application/Volo/Abp/PermissionManagement/PermissionAppService.cs index 2da5ae693b..4bc73a6f86 100644 --- a/modules/permission-management/src/Volo.Abp.PermissionManagement.Application/Volo/Abp/PermissionManagement/PermissionAppService.cs +++ b/modules/permission-management/src/Volo.Abp.PermissionManagement.Application/Volo/Abp/PermissionManagement/PermissionAppService.cs @@ -14,18 +14,20 @@ namespace Volo.Abp.PermissionManagement public class PermissionAppService : ApplicationService, IPermissionAppService { protected PermissionManagementOptions Options { get; } - protected IPermissionManager PermissionManager { get; } protected IPermissionDefinitionManager PermissionDefinitionManager { get; } + protected IPermissionStateManager PermissionStateManager { get; } public PermissionAppService( - IPermissionManager permissionManager, + IPermissionManager permissionManager, IPermissionDefinitionManager permissionDefinitionManager, - IOptions options) + IOptions options, + IPermissionStateManager permissionStateManager) { Options = options.Value; PermissionManager = permissionManager; PermissionDefinitionManager = permissionDefinitionManager; + PermissionStateManager = permissionStateManager; } public virtual async Task GetAsync(string providerName, string providerKey) @@ -56,6 +58,11 @@ namespace Volo.Abp.PermissionManagement continue; } + if (!await PermissionStateManager.IsEnabledAsync(permission)) + { + continue; + } + if (permission.Providers.Any() && !permission.Providers.Contains(providerName)) { continue; diff --git a/modules/permission-management/src/Volo.Abp.PermissionManagement.Domain/Volo/Abp/PermissionManagement/PermissionManager.cs b/modules/permission-management/src/Volo.Abp.PermissionManagement.Domain/Volo/Abp/PermissionManagement/PermissionManager.cs index 1f1e28dfd4..c178a6ae0e 100644 --- a/modules/permission-management/src/Volo.Abp.PermissionManagement.Domain/Volo/Abp/PermissionManagement/PermissionManager.cs +++ b/modules/permission-management/src/Volo.Abp.PermissionManagement.Domain/Volo/Abp/PermissionManagement/PermissionManager.cs @@ -18,6 +18,8 @@ namespace Volo.Abp.PermissionManagement protected IPermissionDefinitionManager PermissionDefinitionManager { get; } + protected IPermissionStateManager PermissionStateManager { get; } + protected IGuidGenerator GuidGenerator { get; } protected ICurrentTenant CurrentTenant { get; } @@ -25,23 +27,25 @@ namespace Volo.Abp.PermissionManagement protected IReadOnlyList ManagementProviders => _lazyProviders.Value; protected PermissionManagementOptions Options { get; } - + protected IDistributedCache Cache { get; } private readonly Lazy> _lazyProviders; public PermissionManager( IPermissionDefinitionManager permissionDefinitionManager, + IPermissionStateManager permissionStateManager, IPermissionGrantRepository permissionGrantRepository, IServiceProvider serviceProvider, IGuidGenerator guidGenerator, IOptions options, - ICurrentTenant currentTenant, + ICurrentTenant currentTenant, IDistributedCache cache) { GuidGenerator = guidGenerator; CurrentTenant = currentTenant; Cache = cache; + PermissionStateManager = permissionStateManager; PermissionGrantRepository = permissionGrantRepository; PermissionDefinitionManager = permissionDefinitionManager; Options = options.Value; @@ -76,7 +80,7 @@ namespace Volo.Abp.PermissionManagement { var permission = PermissionDefinitionManager.Get(permissionName); - if (!permission.IsEnabled) + if (!permission.IsEnabled || !await PermissionStateManager.IsEnabledAsync(permission)) { //TODO: BusinessException throw new ApplicationException($"The permission named '{permission.Name}' is disabled!"); @@ -109,7 +113,7 @@ namespace Volo.Abp.PermissionManagement await provider.SetAsync(permissionName, providerKey, isGranted); } - + public virtual async Task UpdateProviderKeyAsync(PermissionGrant permissionGrant, string providerKey) { using (CurrentTenant.Change(permissionGrant.TenantId)) @@ -123,7 +127,7 @@ namespace Volo.Abp.PermissionManagement ) ); } - + permissionGrant.ProviderKey = providerKey; return await PermissionGrantRepository.UpdateAsync(permissionGrant); } @@ -146,6 +150,11 @@ namespace Volo.Abp.PermissionManagement return result; } + if (!await PermissionStateManager.IsEnabledAsync(permission)) + { + return result; + } + if (!permission.MultiTenancySide.HasFlag(CurrentTenant.GetMultiTenancySide())) { return result; diff --git a/modules/permission-management/test/Volo.Abp.PermissionManagement.Application.Tests/Volo/Abp/PermissionManagement/AbpPermissionManagementApplicationTestBase.cs b/modules/permission-management/test/Volo.Abp.PermissionManagement.Application.Tests/Volo/Abp/PermissionManagement/AbpPermissionManagementApplicationTestBase.cs index 7102b8f851..57cb20ea28 100644 --- a/modules/permission-management/test/Volo.Abp.PermissionManagement.Application.Tests/Volo/Abp/PermissionManagement/AbpPermissionManagementApplicationTestBase.cs +++ b/modules/permission-management/test/Volo.Abp.PermissionManagement.Application.Tests/Volo/Abp/PermissionManagement/AbpPermissionManagementApplicationTestBase.cs @@ -18,7 +18,7 @@ namespace Volo.Abp.PermissionManagement protected override void AfterAddApplication(IServiceCollection services) { var currentUser = Substitute.For(); - //currentUser.Id.Returns(ci => CurrentUserId); + currentUser.Roles.Returns(new []{ "admin" }); currentUser.IsAuthenticated.Returns(true); services.AddSingleton(currentUser); diff --git a/modules/permission-management/test/Volo.Abp.PermissionManagement.Application.Tests/Volo/Abp/PermissionManagement/PermissionAppService_Tests.cs b/modules/permission-management/test/Volo.Abp.PermissionManagement.Application.Tests/Volo/Abp/PermissionManagement/PermissionAppService_Tests.cs index fe528cbc3c..9782e23986 100644 --- a/modules/permission-management/test/Volo.Abp.PermissionManagement.Application.Tests/Volo/Abp/PermissionManagement/PermissionAppService_Tests.cs +++ b/modules/permission-management/test/Volo.Abp.PermissionManagement.Application.Tests/Volo/Abp/PermissionManagement/PermissionAppService_Tests.cs @@ -1,10 +1,12 @@ using System; using System.Collections.Generic; using System.Linq; +using System.Security.Claims; using System.Text; using System.Threading.Tasks; using Shouldly; using Volo.Abp.Authorization.Permissions; +using Volo.Abp.Security.Claims; using Xunit; namespace Volo.Abp.PermissionManagement.Application.Tests.Volo.Abp.PermissionManagement @@ -13,11 +15,13 @@ namespace Volo.Abp.PermissionManagement.Application.Tests.Volo.Abp.PermissionMan { private readonly IPermissionAppService _permissionAppService; private readonly IPermissionGrantRepository _permissionGrantRepository; + private readonly ICurrentPrincipalAccessor _currentPrincipalAccessor; public PermissionAppService_Tests() { _permissionAppService = GetRequiredService(); _permissionGrantRepository = GetRequiredService(); + _currentPrincipalAccessor = GetRequiredService(); } [Fact] @@ -35,7 +39,15 @@ namespace Volo.Abp.PermissionManagement.Application.Tests.Volo.Abp.PermissionMan permissionListResultDto.Groups.First().Permissions.ShouldContain(x => x.Name == "MyPermission2"); permissionListResultDto.Groups.First().Permissions.ShouldContain(x => x.Name == "MyPermission2.ChildPermission1"); permissionListResultDto.Groups.First().Permissions.ShouldContain(x => x.Name == "MyPermission3"); + permissionListResultDto.Groups.First().Permissions.ShouldContain(x => x.Name == "MyPermission4"); + permissionListResultDto.Groups.First().Permissions.ShouldNotContain(x => x.Name == "MyPermission5"); + + using (_currentPrincipalAccessor.Change(new Claim(AbpClaimTypes.Role, "super-admin"))) + { + (await _permissionAppService.GetAsync(UserPermissionValueProvider.ProviderName, PermissionTestDataBuilder.User1Id.ToString())).Groups.First().Permissions + .ShouldContain(x => x.Name == "MyPermission5"); + } } [Fact] diff --git a/modules/permission-management/test/Volo.Abp.PermissionManagement.Domain.Tests/Volo/Abp/PermissionManagement/PermissionChecker_User_Tests.cs b/modules/permission-management/test/Volo.Abp.PermissionManagement.Domain.Tests/Volo/Abp/PermissionManagement/PermissionChecker_User_Tests.cs index 0d455d11d8..e897f409fb 100644 --- a/modules/permission-management/test/Volo.Abp.PermissionManagement.Domain.Tests/Volo/Abp/PermissionManagement/PermissionChecker_User_Tests.cs +++ b/modules/permission-management/test/Volo.Abp.PermissionManagement.Domain.Tests/Volo/Abp/PermissionManagement/PermissionChecker_User_Tests.cs @@ -11,10 +11,12 @@ namespace Volo.Abp.PermissionManagement public class PermissionChecker_User_Tests : PermissionTestBase { private readonly IPermissionChecker _permissionChecker; + private readonly ICurrentPrincipalAccessor _currentPrincipalAccessor; public PermissionChecker_User_Tests() { _permissionChecker = GetRequiredService(); + _currentPrincipalAccessor = GetRequiredService(); } [Fact] @@ -64,6 +66,27 @@ namespace Volo.Abp.PermissionManagement )).ShouldBeFalse(); } + [Fact] + public async Task Should_Return_False_For_Granted_Current_User_If_The_Permission_State_Is_Disabled() + { + (await _permissionChecker.IsGrantedAsync( + CreatePrincipal(PermissionTestDataBuilder.User1Id, Guid.NewGuid()), + "MyPermission5" + )).ShouldBeFalse(); + } + + [Fact] + public async Task Should_Return_True_For_Granted_Current_User_If_The_Permission_State_Is_Enabled() + { + using (_currentPrincipalAccessor.Change(new Claim(AbpClaimTypes.Role, "super-admin"))) + { + (await _permissionChecker.IsGrantedAsync( + CreatePrincipal(PermissionTestDataBuilder.User1Id, Guid.NewGuid()), + "MyPermission5" + )).ShouldBeTrue(); + } + } + private static ClaimsPrincipal CreatePrincipal(Guid? userId, Guid? tenantId = null) { var claimsIdentity = new ClaimsIdentity(); diff --git a/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/PermissionTestDataBuilder.cs b/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/PermissionTestDataBuilder.cs index e763c24d0b..0c504e3a97 100644 --- a/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/PermissionTestDataBuilder.cs +++ b/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/PermissionTestDataBuilder.cs @@ -48,6 +48,15 @@ namespace Volo.Abp.PermissionManagement User1Id.ToString() ) ); + + await _permissionGrantRepository.InsertAsync( + new PermissionGrant( + _guidGenerator.Create(), + "MyPermission5", + UserPermissionValueProvider.ProviderName, + User1Id.ToString() + ) + ); } } -} \ No newline at end of file +} diff --git a/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/TestPermissionDefinitionProvider.cs b/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/TestPermissionDefinitionProvider.cs index c6de42ac3b..103206be1a 100644 --- a/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/TestPermissionDefinitionProvider.cs +++ b/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/TestPermissionDefinitionProvider.cs @@ -18,6 +18,8 @@ namespace Volo.Abp.PermissionManagement testGroup.AddPermission("MyPermission3", multiTenancySide: MultiTenancySides.Host); testGroup.AddPermission("MyPermission4", multiTenancySide: MultiTenancySides.Host).WithProviders(UserPermissionValueProvider.ProviderName); + + testGroup.AddPermission("MyPermission5").AddStateProvider(new TestRequireRolePermissionStateProvider("super-admin")); } } } diff --git a/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/TestRequireRolePermissionStateProvider.cs b/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/TestRequireRolePermissionStateProvider.cs new file mode 100644 index 0000000000..56e34f2894 --- /dev/null +++ b/modules/permission-management/test/Volo.Abp.PermissionManagement.TestBase/Volo/Abp/PermissionManagement/TestRequireRolePermissionStateProvider.cs @@ -0,0 +1,25 @@ +using System.Collections.Generic; +using System.Linq; +using System.Threading.Tasks; +using Microsoft.Extensions.DependencyInjection; +using Volo.Abp.Authorization.Permissions; +using Volo.Abp.Security.Claims; + +namespace Volo.Abp.PermissionManagement +{ + public class TestRequireRolePermissionStateProvider : IPermissionStateProvider + { + private readonly List _allowRoles = new List(); + + public TestRequireRolePermissionStateProvider(params string[] roles) + { + _allowRoles.AddRange(roles); + } + + public Task IsEnabledAsync(PermissionStateContext context) + { + var currentPrincipalAccessor = context.ServiceProvider.GetRequiredService(); + return Task.FromResult(currentPrincipalAccessor.Principal != null && _allowRoles.Any(role => currentPrincipalAccessor.Principal.IsInRole(role))); + } + } +}