TgsAuthorizeAttribute.cs

Go to the documentation of this file.

using System;
 
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Filters;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Logging;
 
using Tgstation.Server.Api.Rights;
using Tgstation.Server.Host.Models;
 
namespace Tgstation.Server.Host.Security
{
#pragma warning disable CA1019
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]
    sealed class TgsAuthorizeAttribute : AuthorizeAttribute, IAuthorizationFilter
    {
        public RightsType? RightsType { get; }
 
        public TgsAuthorizeAttribute()
        {
        }
 
        public TgsAuthorizeAttribute(AdministrationRights requiredRights)
        {
            Roles = RightsHelper.RoleNames(requiredRights);
            RightsType = Api.Rights.RightsType.Administration;
        }
 
        public TgsAuthorizeAttribute(InstanceManagerRights requiredRights)
        {
            Roles = RightsHelper.RoleNames(requiredRights);
            RightsType = Api.Rights.RightsType.InstanceManager;
        }
 
        public TgsAuthorizeAttribute(RepositoryRights requiredRights)
        {
            Roles = RightsHelper.RoleNames(requiredRights);
            RightsType = Api.Rights.RightsType.Repository;
        }
 
        public TgsAuthorizeAttribute(EngineRights requiredRights)
        {
            Roles = RightsHelper.RoleNames(requiredRights);
            RightsType = Api.Rights.RightsType.Engine;
        }
 
        public TgsAuthorizeAttribute(DreamMakerRights requiredRights)
        {
            Roles = RightsHelper.RoleNames(requiredRights);
            RightsType = Api.Rights.RightsType.DreamMaker;
        }
 
        public TgsAuthorizeAttribute(DreamDaemonRights requiredRights)
        {
            Roles = RightsHelper.RoleNames(requiredRights);
            RightsType = Api.Rights.RightsType.DreamDaemon;
        }
 
        public TgsAuthorizeAttribute(ChatBotRights requiredRights)
        {
            Roles = RightsHelper.RoleNames(requiredRights);
            RightsType = Api.Rights.RightsType.ChatBots;
        }
 
        public TgsAuthorizeAttribute(ConfigurationRights requiredRights)
        {
            Roles = RightsHelper.RoleNames(requiredRights);
            RightsType = Api.Rights.RightsType.Configuration;
        }
 
        public TgsAuthorizeAttribute(InstancePermissionSetRights requiredRights)
        {
            Roles = RightsHelper.RoleNames(requiredRights);
            RightsType = Api.Rights.RightsType.InstancePermissionSet;
        }
 
        public void OnAuthorization(AuthorizationFilterContext context)
        {
            var services = context.HttpContext.RequestServices;
            var authenticationContext = services.GetRequiredService<IAuthenticationContext>();
            var logger = services.GetRequiredService<ILogger<TgsAuthorizeAttribute>>();
 
            if (!authenticationContext.Valid)
            {
                logger.LogTrace("authenticationContext is invalid!");
                context.Result = new UnauthorizedResult();
                return;
            }
 
            if (authenticationContext.User.Require(x => x.Enabled))
                return;
 
            logger.LogTrace("authenticationContext is for a disabled user!");
            context.Result = new ForbidResult();
        }
    }
}