Blog posts Permission handling

src/Yavsc/Extensions/PermissionHandler.cs

@@ -1,11 +1,20 @@
 using System.Security.Claims;
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.EntityFrameworkCore;
+using Yavsc.Helpers;
+using Yavsc.Models;
+using Yavsc.Models.Blog;
 using Yavsc.ViewModels.Auth;
 
 namespace Yavsc.Extensions;
 
 public class PermissionHandler : IAuthorizationHandler
 {
+    ApplicationDbContext applicationDbContext;
+    public PermissionHandler(ApplicationDbContext applicationDbContext)
+    {
+        this.applicationDbContext = applicationDbContext;
+    }
     public Task HandleAsync(AuthorizationHandlerContext context)
     {
         var pendingRequirements = context.PendingRequirements.ToList();
@@ -34,13 +43,22 @@ public class PermissionHandler : IAuthorizationHandler
 
     private static bool IsOwner(ClaimsPrincipal user, object? resource)
     {
-        // Code omitted for brevity
-        return true;
+        if (resource is BlogPost blogPost)
+        {
+            return blogPost.AuthorId == user.GetUserId();
+        }
+        return false;
     }
 
-    private static bool IsSponsor(ClaimsPrincipal user, object? resource)
+    private bool IsSponsor(ClaimsPrincipal user, object? resource)
     {
-        // Code omitted for brevity
+        if (resource is BlogPost blogPost)
+        {
+            return applicationDbContext.CircleMembers
+            .Include(c => c.Circle)
+            .Where(m=>m.MemberId==user.GetUserId() && m.Circle.OwnerId == blogPost.OwnerId)
+            .Any();
+        }
         return true;
     }
 }