notazof/yavsc
1
1
Fork 0
Code Issues Pull requests Projects 1 Releases 4 Packages Wiki Activity Actions

Brusher Profile and Blog delete permisssion

Browse source
This commit is contained in:
Paul Schneider 2025-06-28 14:54:44 +01:00
commit fc1775147f
5 changed files with 3571 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/Yavsc/Extensions/PermissionHandler.cs
View file

@ -1,6 +1,7 @@
using System.Security.Claims;
using Microsoft.AspNetCore.Authorization;
using Microsoft.EntityFrameworkCore;
using RazorEngine.Compilation.ImpromptuInterface.Optimization;
using Yavsc.Helpers;
using Yavsc.Models;
using Yavsc.Models.Blog;
@ -55,12 +56,26 @@ public class PermissionHandler : IAuthorizationHandler
return false;
}
private static bool IsOwner(ClaimsPrincipal user, object? resource)
private bool IsOwner(ClaimsPrincipal user, object? resource)
{
if (resource is BlogPost blogPost)
{
return blogPost.AuthorId == user.GetUserId();
}
else
if (resource is DefaultHttpContext httpContext)
{
if (httpContext.Request.Path.StartsWithSegments("/Blogspot/Delete", StringComparison.OrdinalIgnoreCase))
{
string postId = (string)httpContext.GetRouteValue("id");
if (long.TryParse(postId, out long id))
{
BlogPost b = applicationDbContext.BlogSpot.FirstOrDefault(b => b.Id == id && b.AuthorId == user.GetUserId());
return b != null;
}
}
}
return false;
}