mirror of https://github.com/Squidex/squidex.git
Sebastian Stehle
8 years ago
56 changed files with 824 additions and 463 deletions
@ -0,0 +1,6 @@ |
|||||
|
namespace Squidex.Domain.Apps.Core |
||||
|
{ |
||||
|
public sealed class DefaultPermissions |
||||
|
{ |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,119 @@ |
|||||
|
// ==========================================================================
|
||||
|
// Squidex Headless CMS
|
||||
|
// ==========================================================================
|
||||
|
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
||||
|
// All rights reserved. Licensed under the MIT license.
|
||||
|
// ==========================================================================
|
||||
|
|
||||
|
using Squidex.Infrastructure; |
||||
|
using Squidex.Infrastructure.Security; |
||||
|
|
||||
|
namespace Squidex.Domain.Apps.Core |
||||
|
{ |
||||
|
public sealed class Permissions |
||||
|
{ |
||||
|
public const string ClaimType = "Permission"; |
||||
|
|
||||
|
public const string All = "squidex.*"; |
||||
|
|
||||
|
public const string Admin = "squidex.admin*"; |
||||
|
|
||||
|
public const string AdminRestore = "squidex.admin.restore"; |
||||
|
public const string AdminRestoreRead = "squidex.admin.restore.read"; |
||||
|
public const string AdminRestoreCreate = "squidex.admin.restore.create"; |
||||
|
|
||||
|
public const string AdminEvents = "squidex.admin.events"; |
||||
|
public const string AdminEventsRead = "squidex.admin.events.read"; |
||||
|
public const string AdminEventsManage = "squidex.admin.events.manage"; |
||||
|
|
||||
|
public const string AdminUsers = "squidex.admin.users"; |
||||
|
public const string AdminUsersRead = "squidex.admin.users.read"; |
||||
|
public const string AdminUsersCreate = "squidex.admin.users.create"; |
||||
|
public const string AdminUsersUpdate = "squidex.admin.users.update"; |
||||
|
public const string AdminUsersUnlock = "squidex.admin.users.unlock"; |
||||
|
public const string AdminUsersLock = "squidex.admin.users.lock"; |
||||
|
|
||||
|
public const string App = "squidex.apps.{app}"; |
||||
|
public const string AppDelete = "squidex.apps.{app}.delete"; |
||||
|
public const string AppCommon = "squidex.apps.{app}.common"; |
||||
|
|
||||
|
public const string AppClients = "squidex.apps.{app}.clients"; |
||||
|
public const string AppClientsRead = "squidex.apps.{app}.clients.read"; |
||||
|
public const string AppClientsCreate = "squidex.apps.{app}.clients.create"; |
||||
|
public const string AppClientsUpdate = "squidex.apps.{app}.clients.update"; |
||||
|
public const string AppClientsDelete = "squidex.apps.{app}.clients.delete"; |
||||
|
|
||||
|
public const string AppContributors = "squidex.apps.{app}.contributors"; |
||||
|
public const string AppContributorsRead = "squidex.apps.{app}.contributors.read"; |
||||
|
public const string AppContributorsAssign = "squidex.apps.{app}.contributors.assign"; |
||||
|
public const string AppContributorsRevoke = "squidex.apps.{app}.contributors.revoke"; |
||||
|
|
||||
|
public const string AppLanguages = "squidex.apps.{app}.languages"; |
||||
|
public const string AppLanguagesRead = "squidex.apps.{app}.languages.read"; |
||||
|
public const string AppLanguagesCreate = "squidex.apps.{app}.languages.create"; |
||||
|
public const string AppLanguagesUpdate = "squidex.apps.{app}.languages.update"; |
||||
|
public const string AppLanguagesDelete = "squidex.apps.{app}.languages.delete"; |
||||
|
|
||||
|
public const string AppPatterns = "squidex.apps.{app}.patterns"; |
||||
|
public const string AppPatternsRead = "squidex.apps.{app}.patterns.read"; |
||||
|
public const string AppPatternsCreate = "squidex.apps.{app}.patterns.create"; |
||||
|
public const string AppPatternsUpdate = "squidex.apps.{app}.patterns.update"; |
||||
|
public const string AppPatternsDelete = "squidex.apps.{app}.patterns.delete"; |
||||
|
|
||||
|
public const string AppBackups = "squidex.apps.{app}.backups"; |
||||
|
public const string AppBackupsRead = "squidex.apps.{app}.backups.read"; |
||||
|
public const string AppBackupsCreate = "squidex.apps.{app}.backups.create"; |
||||
|
public const string AppBackupsDelete = "squidex.apps.{app}.backups.delete"; |
||||
|
|
||||
|
public const string AppPlans = "squidex.apps.{app}.plans"; |
||||
|
public const string AppPlansRead = "squidex.apps.{app}.plans.read"; |
||||
|
public const string AppPlansChange = "squidex.apps.{app}.plans.change"; |
||||
|
|
||||
|
public const string AppAssets = "squidex.apps.{app}.assets"; |
||||
|
public const string AppAssetsRead = "squidex.apps.{app}.assets.read"; |
||||
|
public const string AppAssetsCreate = "squidex.apps.{app}.assets.create"; |
||||
|
public const string AppAssetsUpdate = "squidex.apps.{app}.assets.update"; |
||||
|
public const string AppAssetsDelete = "squidex.apps.{app}.assets.delete"; |
||||
|
|
||||
|
public const string AppRules = "squidex.apps.{app}.rules"; |
||||
|
public const string AppRulesRead = "squidex.apps.{app}.rules.read"; |
||||
|
public const string AppRulesCreate = "squidex.apps.{app}.rules.create"; |
||||
|
public const string AppRulesUpdate = "squidex.apps.{app}.rules.update"; |
||||
|
public const string AppRulesDisable = "squidex.apps.{app}.rules.disable"; |
||||
|
public const string AppRulesDelete = "squidex.apps.{app}.rules.delete"; |
||||
|
|
||||
|
public const string AppSchemas = "squidex.apps.{app}.schemas.{name}"; |
||||
|
public const string AppSchemasRead = "squidex.apps.{app}.schemas.{name}.read"; |
||||
|
public const string AppSchemasCreate = "squidex.apps.{app}.schemas.{name}.create"; |
||||
|
public const string AppSchemasUpdate = "squidex.apps.{app}.schemas.{name}.update"; |
||||
|
public const string AppSchemasScripts = "squidex.apps.{app}.schemas.{name}.scripts"; |
||||
|
public const string AppSchemasPublish = "squidex.apps.{app}.schemas.{name}.publish"; |
||||
|
public const string AppSchemasDelete = "squidex.apps.{app}.schemas.{name}.delete"; |
||||
|
|
||||
|
public const string AppContents = "squidex.apps.{app}.contents.{name}"; |
||||
|
public const string AppContentsRead = "squidex.apps.{app}.contents.{name}.read"; |
||||
|
public const string AppContentsGraphQL = "squidex.apps.{app}.contents.{name}.graphql"; |
||||
|
public const string AppContentsCreate = "squidex.apps.{app}.contents.{name}.create"; |
||||
|
public const string AppContentsUpdate = "squidex.apps.{app}.contents.{name}.update"; |
||||
|
public const string AppContentsDiscard = "squidex.apps.{app}.contents.{name}.discard"; |
||||
|
public const string AppContentsArchive = "squidex.apps.{app}.contents.{name}.archive"; |
||||
|
public const string AppContentsRestore = "squidex.apps.{app}.contents.{name}.restore"; |
||||
|
public const string AppContentsPublish = "squidex.apps.{app}.contents.{name}.publish"; |
||||
|
public const string AppContentsUnpublish = "squidex.apps.{app}.contents.{name}.unpublish"; |
||||
|
public const string AppContentsDelete = "squidex.apps.{app}.contents.{name}.delete"; |
||||
|
|
||||
|
public static Permission ForApp(string id, string app = "*") |
||||
|
{ |
||||
|
Guard.NotNull(id, nameof(id)); |
||||
|
|
||||
|
return new Permission(id.Replace("{app}", app ?? "*")); |
||||
|
} |
||||
|
|
||||
|
public static Permission ForSchema(string id, string app = "*", string schema = "*") |
||||
|
{ |
||||
|
Guard.NotNull(id, nameof(id)); |
||||
|
|
||||
|
return new Permission(id.Replace("{app}", app ?? "*").Replace("{name}", schema ?? "*")); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,92 @@ |
|||||
|
// ==========================================================================
|
||||
|
// Squidex Headless CMS
|
||||
|
// ==========================================================================
|
||||
|
// Copyright (c) Squidex UG (haftungsbeschraenkt)
|
||||
|
// All rights reserved. Licensed under the MIT license.
|
||||
|
// ==========================================================================
|
||||
|
|
||||
|
using System; |
||||
|
|
||||
|
namespace Squidex.Infrastructure.Security |
||||
|
{ |
||||
|
public sealed class Permission : IComparable<Permission>, IEquatable<Permission> |
||||
|
{ |
||||
|
private const string Any = "*"; |
||||
|
private static readonly char[] Separators = { '.' }; |
||||
|
private readonly string description; |
||||
|
private readonly string id; |
||||
|
private readonly string[] idParts; |
||||
|
|
||||
|
public string Id |
||||
|
{ |
||||
|
get { return id; } |
||||
|
} |
||||
|
|
||||
|
public string Description |
||||
|
{ |
||||
|
get { return description; } |
||||
|
} |
||||
|
|
||||
|
public Permission(string id, string description = null) |
||||
|
{ |
||||
|
Guard.NotNullOrEmpty(id, nameof(id)); |
||||
|
|
||||
|
this.description = description; |
||||
|
|
||||
|
this.id = id; |
||||
|
this.idParts = id.Split(Separators, StringSplitOptions.RemoveEmptyEntries); |
||||
|
} |
||||
|
|
||||
|
public bool GivesPermissionTo(Permission permission) |
||||
|
{ |
||||
|
if (permission == null) |
||||
|
{ |
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
if (idParts.Length > permission.idParts.Length) |
||||
|
{ |
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
for (var i = 0; i < idParts.Length; i++) |
||||
|
{ |
||||
|
var lhs = idParts[i]; |
||||
|
var rhs = permission.idParts[i]; |
||||
|
|
||||
|
if (!string.Equals(lhs, Any, StringComparison.OrdinalIgnoreCase) && |
||||
|
!string.Equals(lhs, rhs, StringComparison.OrdinalIgnoreCase)) |
||||
|
{ |
||||
|
return false; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return true; |
||||
|
} |
||||
|
|
||||
|
public override bool Equals(object obj) |
||||
|
{ |
||||
|
return Equals(obj as Permission); |
||||
|
} |
||||
|
|
||||
|
public bool Equals(Permission other) |
||||
|
{ |
||||
|
return other != null && string.Equals(id, other.id, StringComparison.OrdinalIgnoreCase); |
||||
|
} |
||||
|
|
||||
|
public override int GetHashCode() |
||||
|
{ |
||||
|
return id.GetHashCode(); |
||||
|
} |
||||
|
|
||||
|
public override string ToString() |
||||
|
{ |
||||
|
return id; |
||||
|
} |
||||
|
|
||||
|
public int CompareTo(Permission other) |
||||
|
{ |
||||
|
return other == null ? -1 : string.Compare(id, other.id, StringComparison.Ordinal); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,67 @@ |
|||||
|
// ==========================================================================
|
||||
|
// Squidex Headless CMS
|
||||
|
// ==========================================================================
|
||||
|
// Copyright (c) Squidex UG (haftungsbeschraenkt)
|
||||
|
// All rights reserved. Licensed under the MIT license.
|
||||
|
// ==========================================================================
|
||||
|
|
||||
|
using System.Collections; |
||||
|
using System.Collections.Generic; |
||||
|
using System.Linq; |
||||
|
|
||||
|
namespace Squidex.Infrastructure.Security |
||||
|
{ |
||||
|
public sealed class PermissionSet : IReadOnlyCollection<Permission> |
||||
|
{ |
||||
|
public static readonly PermissionSet Empty = new PermissionSet(); |
||||
|
|
||||
|
private readonly List<Permission> permissions; |
||||
|
|
||||
|
public int Count |
||||
|
{ |
||||
|
get { return permissions.Count; } |
||||
|
} |
||||
|
|
||||
|
public PermissionSet(IEnumerable<Permission> permissions) |
||||
|
{ |
||||
|
Guard.NotNull(permissions, nameof(permissions)); |
||||
|
|
||||
|
this.permissions = permissions.ToList(); |
||||
|
} |
||||
|
|
||||
|
public PermissionSet(params Permission[] permissions) |
||||
|
{ |
||||
|
Guard.NotNull(permissions, nameof(permissions)); |
||||
|
|
||||
|
this.permissions = permissions.ToList(); |
||||
|
} |
||||
|
|
||||
|
public bool GivesPermissionTo(Permission other) |
||||
|
{ |
||||
|
if (other == null) |
||||
|
{ |
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
foreach (var permission in permissions) |
||||
|
{ |
||||
|
if (permission.GivesPermissionTo(other)) |
||||
|
{ |
||||
|
return true; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
public IEnumerator<Permission> GetEnumerator() |
||||
|
{ |
||||
|
return permissions.GetEnumerator(); |
||||
|
} |
||||
|
|
||||
|
IEnumerator IEnumerable.GetEnumerator() |
||||
|
{ |
||||
|
return permissions.GetEnumerator(); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -1,20 +0,0 @@ |
|||||
// ==========================================================================
|
|
||||
// Squidex Headless CMS
|
|
||||
// ==========================================================================
|
|
||||
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
|
||||
// All rights reserved. Licensed under the MIT license.
|
|
||||
// ==========================================================================
|
|
||||
|
|
||||
using IdentityServer4.AccessTokenValidation; |
|
||||
using Microsoft.AspNetCore.Authorization; |
|
||||
|
|
||||
namespace Squidex.Pipeline |
|
||||
{ |
|
||||
public class ApiAuthorizeAttribute : AuthorizeAttribute |
|
||||
{ |
|
||||
public ApiAuthorizeAttribute() |
|
||||
{ |
|
||||
AuthenticationSchemes = IdentityServerAuthenticationDefaults.AuthenticationScheme; |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -0,0 +1,54 @@ |
|||||
|
// ==========================================================================
|
||||
|
// Squidex Headless CMS
|
||||
|
// ==========================================================================
|
||||
|
// Copyright (c) Squidex UG (haftungsbeschraenkt)
|
||||
|
// All rights reserved. Licensed under the MIT license.
|
||||
|
// ==========================================================================
|
||||
|
|
||||
|
using System.Linq; |
||||
|
using System.Threading.Tasks; |
||||
|
using IdentityServer4.AccessTokenValidation; |
||||
|
using Microsoft.AspNetCore.Authorization; |
||||
|
using Microsoft.AspNetCore.Mvc; |
||||
|
using Microsoft.AspNetCore.Mvc.Filters; |
||||
|
using Squidex.Infrastructure.Security; |
||||
|
|
||||
|
namespace Squidex.Pipeline |
||||
|
{ |
||||
|
public sealed class ApiPermissionAttribute : AuthorizeAttribute, IAsyncActionFilter |
||||
|
{ |
||||
|
private readonly string permissionId; |
||||
|
|
||||
|
public ApiPermissionAttribute(string id = null) |
||||
|
{ |
||||
|
AuthenticationSchemes = IdentityServerAuthenticationDefaults.AuthenticationScheme; |
||||
|
|
||||
|
permissionId = id; |
||||
|
} |
||||
|
|
||||
|
public Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next) |
||||
|
{ |
||||
|
if (permissionId != null) |
||||
|
{ |
||||
|
var id = permissionId; |
||||
|
|
||||
|
foreach (var routeParam in context.RouteData.Values) |
||||
|
{ |
||||
|
id = id.Replace($"{{{routeParam.Key}}}", routeParam.Value?.ToString()); |
||||
|
} |
||||
|
|
||||
|
var set = new PermissionSet( |
||||
|
context.HttpContext.User.FindAll("Permission") |
||||
|
.Select(x => x.Value) |
||||
|
.Select(x => new Permission(x))); |
||||
|
|
||||
|
if (!set.GivesPermissionTo(new Permission(id))) |
||||
|
{ |
||||
|
// context.Result = new StatusCodeResult(403);
|
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return next(); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -1,19 +0,0 @@ |
|||||
// ==========================================================================
|
|
||||
// Squidex Headless CMS
|
|
||||
// ==========================================================================
|
|
||||
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
|
||||
// All rights reserved. Licensed under the MIT license.
|
|
||||
// ==========================================================================
|
|
||||
|
|
||||
using Microsoft.AspNetCore.Mvc; |
|
||||
|
|
||||
namespace Squidex.Pipeline |
|
||||
{ |
|
||||
public sealed class AppApiAttribute : ServiceFilterAttribute |
|
||||
{ |
|
||||
public AppApiAttribute() |
|
||||
: base(typeof(AppApiFilter)) |
|
||||
{ |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -1,55 +0,0 @@ |
|||||
// ==========================================================================
|
|
||||
// Squidex Headless CMS
|
|
||||
// ==========================================================================
|
|
||||
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
|
||||
// All rights reserved. Licensed under the MIT license.
|
|
||||
// ==========================================================================
|
|
||||
|
|
||||
using System.Threading.Tasks; |
|
||||
using Microsoft.AspNetCore.Mvc; |
|
||||
using Microsoft.AspNetCore.Mvc.Filters; |
|
||||
using Squidex.Domain.Apps.Entities; |
|
||||
using Squidex.Domain.Apps.Entities.Apps; |
|
||||
|
|
||||
namespace Squidex.Pipeline |
|
||||
{ |
|
||||
public sealed class AppApiFilter : IAsyncActionFilter |
|
||||
{ |
|
||||
private readonly IAppProvider appProvider; |
|
||||
|
|
||||
public class AppFeature : IAppFeature |
|
||||
{ |
|
||||
public IAppEntity App { get; } |
|
||||
|
|
||||
public AppFeature(IAppEntity app) |
|
||||
{ |
|
||||
App = app; |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
public AppApiFilter(IAppProvider appProvider) |
|
||||
{ |
|
||||
this.appProvider = appProvider; |
|
||||
} |
|
||||
|
|
||||
public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next) |
|
||||
{ |
|
||||
var appName = context.RouteData.Values["app"]?.ToString(); |
|
||||
|
|
||||
if (!string.IsNullOrWhiteSpace(appName)) |
|
||||
{ |
|
||||
var app = await appProvider.GetAppAsync(appName); |
|
||||
|
|
||||
if (app == null) |
|
||||
{ |
|
||||
context.Result = new NotFoundResult(); |
|
||||
return; |
|
||||
} |
|
||||
|
|
||||
context.HttpContext.Features.Set<IAppFeature>(new AppFeature(app)); |
|
||||
} |
|
||||
|
|
||||
await next(); |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -1,106 +0,0 @@ |
|||||
// ==========================================================================
|
|
||||
// Squidex Headless CMS
|
|
||||
// ==========================================================================
|
|
||||
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
|
||||
// All rights reserved. Licensed under the MIT license.
|
|
||||
// ==========================================================================
|
|
||||
|
|
||||
using System.Collections.Generic; |
|
||||
using System.Linq; |
|
||||
using System.Security.Claims; |
|
||||
using Microsoft.AspNetCore.Mvc; |
|
||||
using Microsoft.AspNetCore.Mvc.Filters; |
|
||||
using Squidex.Domain.Apps.Core.Apps; |
|
||||
using Squidex.Domain.Apps.Entities.Apps; |
|
||||
using Squidex.Infrastructure.Security; |
|
||||
using Squidex.Shared.Identity; |
|
||||
|
|
||||
namespace Squidex.Pipeline |
|
||||
{ |
|
||||
public abstract class AppPermissionAttribute : ActionFilterAttribute |
|
||||
{ |
|
||||
private readonly AppPermission requestedPermission; |
|
||||
|
|
||||
protected AppPermissionAttribute(AppPermission requestedPermission) |
|
||||
{ |
|
||||
this.requestedPermission = requestedPermission; |
|
||||
} |
|
||||
|
|
||||
public override void OnActionExecuting(ActionExecutingContext context) |
|
||||
{ |
|
||||
var app = context.HttpContext.Features.Get<IAppFeature>()?.App; |
|
||||
|
|
||||
if (app != null) |
|
||||
{ |
|
||||
var user = context.HttpContext.User; |
|
||||
|
|
||||
var permission = |
|
||||
FindByOpenIdSubject(app, user) ?? |
|
||||
FindByOpenIdClient(app, user); |
|
||||
|
|
||||
if (permission == null) |
|
||||
{ |
|
||||
context.Result = new NotFoundResult(); |
|
||||
return; |
|
||||
} |
|
||||
|
|
||||
if (permission.Value > requestedPermission) |
|
||||
{ |
|
||||
context.Result = new StatusCodeResult(403); |
|
||||
return; |
|
||||
} |
|
||||
|
|
||||
var defaultIdentity = context.HttpContext.User.Identities.First(); |
|
||||
|
|
||||
var additionalRoles = new List<string> |
|
||||
{ |
|
||||
SquidexRoles.AppReader |
|
||||
}; |
|
||||
|
|
||||
if (permission.Value <= AppPermission.Editor) |
|
||||
{ |
|
||||
additionalRoles.Add(SquidexRoles.AppEditor); |
|
||||
} |
|
||||
|
|
||||
if (permission.Value <= AppPermission.Developer) |
|
||||
{ |
|
||||
additionalRoles.Add(SquidexRoles.AppDeveloper); |
|
||||
} |
|
||||
|
|
||||
if (permission.Value <= AppPermission.Owner) |
|
||||
{ |
|
||||
additionalRoles.Add(SquidexRoles.AppOwner); |
|
||||
} |
|
||||
|
|
||||
foreach (var role in additionalRoles) |
|
||||
{ |
|
||||
defaultIdentity.AddClaim(new Claim(defaultIdentity.RoleClaimType, role)); |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
private static AppPermission? FindByOpenIdClient(IAppEntity app, ClaimsPrincipal user) |
|
||||
{ |
|
||||
var clientId = user.GetClientId(); |
|
||||
|
|
||||
if (clientId != null && app.Clients.TryGetValue(clientId, out var client)) |
|
||||
{ |
|
||||
return client.Permission.ToAppPermission(); |
|
||||
} |
|
||||
|
|
||||
return null; |
|
||||
} |
|
||||
|
|
||||
private static AppPermission? FindByOpenIdSubject(IAppEntity app, ClaimsPrincipal user) |
|
||||
{ |
|
||||
var subjectId = user.FindFirst(OpenIdClaims.Subject)?.Value; |
|
||||
|
|
||||
if (subjectId != null && app.Contributors.TryGetValue(subjectId, out var permission)) |
|
||||
{ |
|
||||
return permission.ToAppPermission(); |
|
||||
} |
|
||||
|
|
||||
return null; |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -0,0 +1,102 @@ |
|||||
|
// ==========================================================================
|
||||
|
// Squidex Headless CMS
|
||||
|
// ==========================================================================
|
||||
|
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
||||
|
// All rights reserved. Licensed under the MIT license.
|
||||
|
// ==========================================================================
|
||||
|
|
||||
|
using System.Linq; |
||||
|
using System.Security.Claims; |
||||
|
using System.Threading.Tasks; |
||||
|
using Microsoft.AspNetCore.Mvc; |
||||
|
using Microsoft.AspNetCore.Mvc.Filters; |
||||
|
using Squidex.Domain.Apps.Core.Apps; |
||||
|
using Squidex.Domain.Apps.Entities; |
||||
|
using Squidex.Domain.Apps.Entities.Apps; |
||||
|
using Squidex.Infrastructure.Security; |
||||
|
|
||||
|
namespace Squidex.Pipeline |
||||
|
{ |
||||
|
public sealed class AppResolverFilter : IAsyncActionFilter |
||||
|
{ |
||||
|
private readonly IAppProvider appProvider; |
||||
|
|
||||
|
public class AppFeature : IAppFeature |
||||
|
{ |
||||
|
public IAppEntity App { get; } |
||||
|
|
||||
|
public AppFeature(IAppEntity app) |
||||
|
{ |
||||
|
App = app; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
public AppResolverFilter(IAppProvider appProvider) |
||||
|
{ |
||||
|
this.appProvider = appProvider; |
||||
|
} |
||||
|
|
||||
|
public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next) |
||||
|
{ |
||||
|
var appName = context.RouteData.Values["app"]?.ToString(); |
||||
|
|
||||
|
if (!string.IsNullOrWhiteSpace(appName)) |
||||
|
{ |
||||
|
var app = await appProvider.GetAppAsync(appName); |
||||
|
|
||||
|
if (app == null) |
||||
|
{ |
||||
|
context.Result = new NotFoundResult(); |
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
var user = context.HttpContext.User; |
||||
|
|
||||
|
var permissions = |
||||
|
FindByOpenIdSubject(app, user) ?? |
||||
|
FindByOpenIdClient(app, user); |
||||
|
|
||||
|
if (permissions.Count == 0) |
||||
|
{ |
||||
|
context.Result = new NotFoundResult(); |
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
var identity = user.Identities.First(); |
||||
|
|
||||
|
foreach (var permission in permissions) |
||||
|
{ |
||||
|
identity.AddClaim(new Claim("Permission", permission.Id)); |
||||
|
} |
||||
|
|
||||
|
context.HttpContext.Features.Set<IAppFeature>(new AppFeature(app)); |
||||
|
} |
||||
|
|
||||
|
await next(); |
||||
|
} |
||||
|
|
||||
|
private static PermissionSet FindByOpenIdClient(IAppEntity app, ClaimsPrincipal user) |
||||
|
{ |
||||
|
var clientId = user.GetClientId(); |
||||
|
|
||||
|
if (clientId != null && app.Clients.TryGetValue(clientId, out var client)) |
||||
|
{ |
||||
|
return client.Permission.ToPermissions(app.Name); |
||||
|
} |
||||
|
|
||||
|
return PermissionSet.Empty; |
||||
|
} |
||||
|
|
||||
|
private static PermissionSet FindByOpenIdSubject(IAppEntity app, ClaimsPrincipal user) |
||||
|
{ |
||||
|
var subjectId = user.FindFirst(OpenIdClaims.Subject)?.Value; |
||||
|
|
||||
|
if (subjectId != null && app.Contributors.TryGetValue(subjectId, out var permission)) |
||||
|
{ |
||||
|
return permission.ToPermissions(app.Name); |
||||
|
} |
||||
|
|
||||
|
return PermissionSet.Empty; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -1,19 +0,0 @@ |
|||||
// ==========================================================================
|
|
||||
// Squidex Headless CMS
|
|
||||
// ==========================================================================
|
|
||||
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
|
||||
// All rights reserved. Licensed under the MIT license.
|
|
||||
// ==========================================================================
|
|
||||
|
|
||||
using Squidex.Shared.Identity; |
|
||||
|
|
||||
namespace Squidex.Pipeline |
|
||||
{ |
|
||||
public sealed class MustBeAdministratorAttribute : ApiAuthorizeAttribute |
|
||||
{ |
|
||||
public MustBeAdministratorAttribute() |
|
||||
{ |
|
||||
Roles = SquidexRoles.Administrator; |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -1,19 +0,0 @@ |
|||||
// ==========================================================================
|
|
||||
// Squidex Headless CMS
|
|
||||
// ==========================================================================
|
|
||||
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
|
||||
// All rights reserved. Licensed under the MIT license.
|
|
||||
// ==========================================================================
|
|
||||
|
|
||||
using Squidex.Domain.Apps.Core.Apps; |
|
||||
|
|
||||
namespace Squidex.Pipeline |
|
||||
{ |
|
||||
public sealed class MustBeAppDeveloperAttribute : AppPermissionAttribute |
|
||||
{ |
|
||||
public MustBeAppDeveloperAttribute() |
|
||||
: base(AppPermission.Developer) |
|
||||
{ |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -1,19 +0,0 @@ |
|||||
// ==========================================================================
|
|
||||
// Squidex Headless CMS
|
|
||||
// ==========================================================================
|
|
||||
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
|
||||
// All rights reserved. Licensed under the MIT license.
|
|
||||
// ==========================================================================
|
|
||||
|
|
||||
using Squidex.Domain.Apps.Core.Apps; |
|
||||
|
|
||||
namespace Squidex.Pipeline |
|
||||
{ |
|
||||
public sealed class MustBeAppEditorAttribute : AppPermissionAttribute |
|
||||
{ |
|
||||
public MustBeAppEditorAttribute() |
|
||||
: base(AppPermission.Editor) |
|
||||
{ |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -1,19 +0,0 @@ |
|||||
// ==========================================================================
|
|
||||
// Squidex Headless CMS
|
|
||||
// ==========================================================================
|
|
||||
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
|
||||
// All rights reserved. Licensed under the MIT license.
|
|
||||
// ==========================================================================
|
|
||||
|
|
||||
using Squidex.Domain.Apps.Core.Apps; |
|
||||
|
|
||||
namespace Squidex.Pipeline |
|
||||
{ |
|
||||
public sealed class MustBeAppOwnerAttribute : AppPermissionAttribute |
|
||||
{ |
|
||||
public MustBeAppOwnerAttribute() |
|
||||
: base(AppPermission.Owner) |
|
||||
{ |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -1,19 +0,0 @@ |
|||||
// ==========================================================================
|
|
||||
// Squidex Headless CMS
|
|
||||
// ==========================================================================
|
|
||||
// Copyright (c) Squidex UG (haftungsbeschränkt)
|
|
||||
// All rights reserved. Licensed under the MIT license.
|
|
||||
// ==========================================================================
|
|
||||
|
|
||||
using Squidex.Domain.Apps.Core.Apps; |
|
||||
|
|
||||
namespace Squidex.Pipeline |
|
||||
{ |
|
||||
public sealed class MustBeAppReaderAttribute : AppPermissionAttribute |
|
||||
{ |
|
||||
public MustBeAppReaderAttribute() |
|
||||
: base(AppPermission.Reader) |
|
||||
{ |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -0,0 +1,65 @@ |
|||||
|
// ==========================================================================
|
||||
|
// Squidex Headless CMS
|
||||
|
// ==========================================================================
|
||||
|
// Copyright (c) Squidex UG (haftungsbeschraenkt)
|
||||
|
// All rights reserved. Licensed under the MIT license.
|
||||
|
// ==========================================================================
|
||||
|
|
||||
|
using System.Collections; |
||||
|
using System.Collections.Generic; |
||||
|
using System.Linq; |
||||
|
using Xunit; |
||||
|
|
||||
|
namespace Squidex.Infrastructure.Security |
||||
|
{ |
||||
|
public sealed class PermissionSetTests |
||||
|
{ |
||||
|
[Fact] |
||||
|
public void Should_provide_collection_features() |
||||
|
{ |
||||
|
var source = new List<Permission> |
||||
|
{ |
||||
|
new Permission("c"), |
||||
|
new Permission("b"), |
||||
|
new Permission("a") |
||||
|
}; |
||||
|
|
||||
|
var sut = new PermissionSet(source); |
||||
|
|
||||
|
Assert.Equal(sut.ToList(), source); |
||||
|
Assert.Equal(((IEnumerable)sut).OfType<Permission>().ToList(), source); |
||||
|
|
||||
|
Assert.Equal(3, source.Count); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_true_if_any_permission_gives_permission_to_request() |
||||
|
{ |
||||
|
var sut = new PermissionSet( |
||||
|
new Permission("app.contents"), |
||||
|
new Permission("app.assets")); |
||||
|
|
||||
|
Assert.True(sut.GivesPermissionTo(new Permission("app.contents"))); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_false_if_none_permission_gives_permission_to_request() |
||||
|
{ |
||||
|
var sut = new PermissionSet( |
||||
|
new Permission("app.contents"), |
||||
|
new Permission("app.assets")); |
||||
|
|
||||
|
Assert.False(sut.GivesPermissionTo(new Permission("app.schemas"))); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_false_if_permission_to_request_is_null() |
||||
|
{ |
||||
|
var sut = new PermissionSet( |
||||
|
new Permission("app.contents"), |
||||
|
new Permission("app.assets")); |
||||
|
|
||||
|
Assert.False(sut.GivesPermissionTo(null)); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,138 @@ |
|||||
|
// ==========================================================================
|
||||
|
// Squidex Headless CMS
|
||||
|
// ==========================================================================
|
||||
|
// Copyright (c) Squidex UG (haftungsbeschraenkt)
|
||||
|
// All rights reserved. Licensed under the MIT license.
|
||||
|
// ==========================================================================
|
||||
|
|
||||
|
using System.Collections.Generic; |
||||
|
using System.Linq; |
||||
|
using Xunit; |
||||
|
|
||||
|
namespace Squidex.Infrastructure.Security |
||||
|
{ |
||||
|
public class PermissionTests |
||||
|
{ |
||||
|
[Fact] |
||||
|
public void Should_generate_permissions() |
||||
|
{ |
||||
|
var sut = new Permission("app.contents", "App Contents"); |
||||
|
|
||||
|
Assert.Equal("app.contents", sut.ToString()); |
||||
|
Assert.Equal("app.contents", sut.Id); |
||||
|
Assert.Equal("App Contents", sut.Description); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_true_if_given_and_requested_permission_have_wildcards() |
||||
|
{ |
||||
|
var g = new Permission("app.*"); |
||||
|
var r = new Permission("app.*"); |
||||
|
|
||||
|
Assert.True(g.GivesPermissionTo(r)); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_true_if_given_permission_equals_requested_permission() |
||||
|
{ |
||||
|
var g = new Permission("app.contents"); |
||||
|
var r = new Permission("app.contents"); |
||||
|
|
||||
|
Assert.True(g.GivesPermissionTo(r)); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_true_if_given_permission_is_parent_of_requested_permission() |
||||
|
{ |
||||
|
var g = new Permission("app"); |
||||
|
var r = new Permission("app.contents"); |
||||
|
|
||||
|
Assert.True(g.GivesPermissionTo(r)); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_true_if_given_permission_has_wildcard_for_requested_permission() |
||||
|
{ |
||||
|
var g = new Permission("app.*"); |
||||
|
var r = new Permission("app.contents"); |
||||
|
|
||||
|
Assert.True(g.GivesPermissionTo(r)); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_false_if_given_permission_not_equals_requested_permission() |
||||
|
{ |
||||
|
var g = new Permission("app.contents"); |
||||
|
var r = new Permission("app.assets"); |
||||
|
|
||||
|
Assert.False(g.GivesPermissionTo(r)); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_false_if_given_permission_is_child_of_requested_permission() |
||||
|
{ |
||||
|
var g = new Permission("app.contents"); |
||||
|
var r = new Permission("app"); |
||||
|
|
||||
|
Assert.False(g.GivesPermissionTo(r)); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_false_if_given_permission_has_no_wildcard_but_requested_has() |
||||
|
{ |
||||
|
var g = new Permission("app.contents"); |
||||
|
var r = new Permission("app.*"); |
||||
|
|
||||
|
Assert.False(g.GivesPermissionTo(r)); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_return_false_if_given_requested_permission_is_null() |
||||
|
{ |
||||
|
var g = new Permission("app.contents"); |
||||
|
|
||||
|
Assert.False(g.GivesPermissionTo(null)); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_make_correct_object_equal_comparisons() |
||||
|
{ |
||||
|
object permission1a = new Permission("app.1"); |
||||
|
object permission1b = new Permission("app.1"); |
||||
|
object permission2a = new Permission("app.2"); |
||||
|
|
||||
|
Assert.True(permission1a.Equals(permission1b)); |
||||
|
|
||||
|
Assert.False(permission1a.Equals(permission2a)); |
||||
|
Assert.False(permission1b.Equals(permission2a)); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_provide_correct_hash_codes() |
||||
|
{ |
||||
|
var permission1a = new Permission("app.1"); |
||||
|
var permission1b = new Permission("app.1"); |
||||
|
var permission2a = new Permission("app.2"); |
||||
|
|
||||
|
Assert.Equal(permission1a.GetHashCode(), permission1b.GetHashCode()); |
||||
|
|
||||
|
Assert.NotEqual(permission1a.GetHashCode(), permission2a.GetHashCode()); |
||||
|
Assert.NotEqual(permission1b.GetHashCode(), permission2a.GetHashCode()); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_sort_by_name() |
||||
|
{ |
||||
|
var source = new List<Permission> |
||||
|
{ |
||||
|
new Permission("c"), |
||||
|
new Permission("b"), |
||||
|
new Permission("a") |
||||
|
}; |
||||
|
|
||||
|
var sorted = source.OrderBy(x => x).ToList(); |
||||
|
|
||||
|
Assert.Equal(new List<Permission> { source[2], source[1], source[0] }, sorted); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue