notazof/yavsc
1
1
Fork 0
Code Issues 1 Pull requests 1 Projects 2 Releases 9 Packages Wiki Activity Actions

Not a final solution,dealing with 403 status codes ...

Browse source
This commit is contained in:
Paul Schneider 2020-10-17 23:40:37 +01:00
commit a68f7ed6a0
10 changed files with 253 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

40
src/Yavsc/AuthorizationHandlers/ViewFileHandler.cs
View file

@ -1,29 +1,37 @@
using Microsoft.AspNet.Authorization;
using Microsoft.Extensions.Logging;
using Newtonsoft.Json;
using Yavsc.Services;
using Yavsc.ViewModels.Auth;
namespace Yavsc.AuthorizationHandlers {
namespace Yavsc.AuthorizationHandlers
{
public class ViewFileHandler : AuthorizationHandler<ViewRequirement, ViewFileContext> {
public class ViewFileHandler : AuthorizationHandler<ViewRequirement, ViewFileContext>
{
readonly IFileSystemAuthManager _authManager;
private readonly ILogger _logger;
public ViewFileHandler (IFileSystemAuthManager authManager) {
public ViewFileHandler(IFileSystemAuthManager authManager, ILoggerFactory logFactory)
{
_authManager = authManager;
_logger = logFactory.CreateLogger<ViewFileHandler>();
}
protected override void Handle (AuthorizationContext context, ViewRequirement requirement, ViewFileContext fileContext) {
// TODO file access rules
if (fileContext.Path.StartsWith ("/pub/"))
context.Succeed (requirement);
else {
if (!fileContext.Path.StartsWith ("/"))
context.Fail ();
else {
var rights = _authManager.GetFilePathAccess (context.User, fileContext.Path);
if ((rights & FileAccessRight.Read) > 0)
context.Succeed (requirement);
else context.Fail ();
}
protected override void Handle(AuthorizationContext context, ViewRequirement requirement, ViewFileContext fileContext)
{
var rights = _authManager.GetFilePathAccess(context.User, fileContext.File);
_logger.LogInformation("Got access value : " + rights);
if ((rights & FileAccessRight.Read) > 0)
{
_logger.LogInformation("Allowing access");
context.Succeed(requirement);
}
else
{
_logger.LogInformation("Denying access");
context.Fail();
}
}
}