bug fixes

src/Yavsc/Extensions/HostingExtensions.cs

@@ -29,6 +29,7 @@ using Yavsc.Models.Market;
 using Yavsc.Models.Workflow;
 using Yavsc.Services;
 using Yavsc.Settings;
+using Yavsc.ViewModels.Auth;
 
 namespace Yavsc.Extensions;
 
@@ -308,7 +309,12 @@ internal static class HostingExtensions
                 // options.AddPolicy("EmployeeId", policy => policy.RequireClaim("EmployeeId", "123", "456"));
                 // options.AddPolicy("BuildingEntry", policy => policy.Requirements.Add(new OfficeEntryRequirement()));
                 options.AddPolicy("Authenticated", policy => policy.RequireAuthenticatedUser());
+                 options.AddPolicy("IsTheAuthor", policy =>
+                    policy.Requirements.Add(new EditPermission()));
             });
+           
+            services.AddSingleton<IAuthorizationHandler, PermissionHandler>();
+
             _ = services.AddControllersWithViews()
             .AddNewtonsoftJson();
             LoadGoogleConfig(builder.Configuration);

src/Yavsc/Extensions/PermissionHandler.cs

@@ -0,0 +1,46 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Authorization;
+using Yavsc.ViewModels.Auth;
+
+namespace Yavsc.Extensions;
+
+public class PermissionHandler : IAuthorizationHandler
+{
+    public Task HandleAsync(AuthorizationHandlerContext context)
+    {
+        var pendingRequirements = context.PendingRequirements.ToList();
+
+        foreach (var requirement in pendingRequirements)
+        {
+            if (requirement is ReadPermission)
+            {
+                if (IsOwner(context.User, context.Resource)
+                    || IsSponsor(context.User, context.Resource))
+                {
+                    context.Succeed(requirement);
+                }
+            }
+            else if (requirement is EditPermission || requirement is DeletePermission)
+            {
+                if (IsOwner(context.User, context.Resource))
+                {
+                    context.Succeed(requirement);
+                }
+            }
+        }
+
+        return Task.CompletedTask;
+    }
+
+    private static bool IsOwner(ClaimsPrincipal user, object? resource)
+    {
+        // Code omitted for brevity
+        return true;
+    }
+
+    private static bool IsSponsor(ClaimsPrincipal user, object? resource)
+    {
+        // Code omitted for brevity
+        return true;
+    }
+}