Skip to content

Commit c187986

Browse files
artem-dudarevartem-dudarev
committed
VCST-2969: Add missing permission checks (#2907)
1 parent 751ee80 commit c187986

File tree

3 files changed

+61
-40
lines changed

3 files changed

+61
-40
lines changed

‎src/VirtoCommerce.Platform.Core/PlatformConstants.cs

Lines changed: 54 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,12 @@ public static class Claims
2525
public const string UserNameClaimType = "username";
2626
public const string LimitedPermissionsClaimType = "limited_permissions";
2727
public const string MemberIdClaimType = "memberId";
28+
2829
/// <summary>
29-
/// Represents Operator User Id after impersonation
30+
/// Represents Operator User ID after impersonation
3031
/// </summary>
3132
public const string OperatorUserId = "vc_operator_user_id";
33+
3234
/// <summary>
3335
/// Represents Operator User Name after impersonation
3436
/// </summary>
@@ -46,48 +48,60 @@ public static class Permissions
4648
{
4749
public const string ResetCache = "cache:reset";
4850

49-
public const string AssetAccess = "platform:asset:access",
50-
AssetDelete = "platform:asset:delete",
51-
AssetUpdate = "platform:asset:update",
52-
AssetCreate = "platform:asset:create",
53-
AssetRead = "platform:asset:read";
54-
55-
public const string ModuleQuery = "platform:module:read",
56-
ModuleAccess = "platform:module:access",
57-
ModuleManage = "platform:module:manage";
58-
59-
public const string SettingQuery = "platform:setting:read",
60-
SettingAccess = "platform:setting:access",
61-
SettingUpdate = "platform:setting:update";
62-
63-
public const string DynamicPropertiesQuery = "platform:dynamic_properties:read",
64-
DynamicPropertiesCreate = "platform:dynamic_properties:create",
65-
DynamicPropertiesAccess = "platform:dynamic_properties:access",
66-
DynamicPropertiesUpdate = "platform:dynamic_properties:update",
67-
DynamicPropertiesDelete = "platform:dynamic_properties:delete";
68-
69-
public const string SecurityQuery = "platform:security:read",
70-
SecurityCreate = "platform:security:create",
71-
SecurityAccess = "platform:security:access",
72-
SecurityUpdate = "platform:security:update",
73-
SecurityDelete = "platform:security:delete",
74-
SecurityVerifyEmail = "platform:security:verifyEmail",
75-
SecurityLoginOnBehalf = "platform:security:loginOnBehalf",
76-
SecurityConfirmEmail = "platform:security:confirmEmail",
77-
SecurityGenerateToken = "platform:security:generateToken",
78-
SecurityVerifyToken = "platform:security:verifyToken";
51+
public const string AssetAccess = "platform:asset:access";
52+
public const string AssetDelete = "platform:asset:delete";
53+
public const string AssetUpdate = "platform:asset:update";
54+
public const string AssetCreate = "platform:asset:create";
55+
public const string AssetRead = "platform:asset:read";
56+
57+
public const string ModuleQuery = "platform:module:read";
58+
public const string ModuleAccess = "platform:module:access";
59+
public const string ModuleManage = "platform:module:manage";
60+
61+
public const string SettingQuery = "platform:setting:read";
62+
public const string SettingAccess = "platform:setting:access";
63+
public const string SettingUpdate = "platform:setting:update";
64+
65+
public const string DynamicPropertiesQuery = "platform:dynamic_properties:read";
66+
public const string DynamicPropertiesCreate = "platform:dynamic_properties:create";
67+
public const string DynamicPropertiesAccess = "platform:dynamic_properties:access";
68+
public const string DynamicPropertiesUpdate = "platform:dynamic_properties:update";
69+
public const string DynamicPropertiesDelete = "platform:dynamic_properties:delete";
70+
71+
public const string SecurityQuery = "platform:security:read";
72+
public const string SecurityCreate = "platform:security:create";
73+
public const string SecurityAccess = "platform:security:access";
74+
public const string SecurityUpdate = "platform:security:update";
75+
public const string SecurityDelete = "platform:security:delete";
76+
public const string SecurityLoginOnBehalf = "platform:security:loginOnBehalf";
77+
public const string SecurityVerifyEmail = "platform:security:verifyEmail";
78+
public const string SecurityConfirmEmail = "platform:security:confirmEmail";
79+
public const string SecurityGenerateToken = "platform:security:generateToken";
80+
public const string SecurityVerifyToken = "platform:security:verifyToken";
81+
public const string SecurityOAuthApplicationsCreate = "platform:security:oauth_applications:create";
82+
public const string SecurityOAuthApplicationsRead = "platform:security:oauth_applications:read";
83+
public const string SecurityOAuthApplicationsUpdate = "platform:security:oauth_applications:update";
84+
public const string SecurityOAuthApplicationsDelete = "platform:security:oauth_applications:delete";
7985

8086
public const string BackgroundJobsManage = "background_jobs:manage";
8187

82-
public const string PlatformExportImportAccess = "platform:exportImport:access",
83-
PlatformImport = "platform:import",
84-
PlatformExport = "platform:export";
85-
86-
public static string[] AllPermissions { get; } = new[] { ResetCache, AssetAccess, AssetDelete, AssetUpdate, AssetCreate, AssetRead, ModuleQuery, ModuleAccess, ModuleManage,
87-
SettingQuery, SettingAccess, SettingUpdate, DynamicPropertiesQuery, DynamicPropertiesCreate, DynamicPropertiesAccess, DynamicPropertiesUpdate, DynamicPropertiesDelete,
88-
SecurityQuery, SecurityCreate, SecurityAccess, SecurityUpdate, SecurityDelete, BackgroundJobsManage, PlatformExportImportAccess, PlatformImport, PlatformExport, SecurityLoginOnBehalf ,
89-
SecurityVerifyEmail, SecurityConfirmEmail, SecurityGenerateToken, SecurityVerifyToken,
90-
};
88+
public const string PlatformExportImportAccess = "platform:exportImport:access";
89+
public const string PlatformImport = "platform:import";
90+
public const string PlatformExport = "platform:export";
91+
92+
public static string[] AllPermissions { get; } =
93+
[
94+
ResetCache,
95+
AssetAccess, AssetDelete, AssetUpdate, AssetCreate, AssetRead,
96+
ModuleQuery, ModuleAccess, ModuleManage,
97+
SettingQuery, SettingAccess, SettingUpdate,
98+
DynamicPropertiesQuery, DynamicPropertiesCreate, DynamicPropertiesAccess, DynamicPropertiesUpdate, DynamicPropertiesDelete,
99+
SecurityQuery, SecurityCreate, SecurityAccess, SecurityUpdate, SecurityDelete,
100+
SecurityLoginOnBehalf, SecurityVerifyEmail, SecurityConfirmEmail, SecurityGenerateToken, SecurityVerifyToken,
101+
SecurityOAuthApplicationsCreate, SecurityOAuthApplicationsRead, SecurityOAuthApplicationsUpdate, SecurityOAuthApplicationsDelete,
102+
BackgroundJobsManage,
103+
PlatformExportImportAccess, PlatformImport, PlatformExport,
104+
];
91105
}
92106

93107
public static class Changes

‎src/VirtoCommerce.Platform.Web/Controllers/Api/OAuthAppsController.cs

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
using OpenIddict.EntityFrameworkCore.Models;
1010
using VirtoCommerce.Platform.Core.Common;
1111
using VirtoCommerce.Platform.Web.Model.Security;
12+
using Permissions = VirtoCommerce.Platform.Core.PlatformConstants.Security.Permissions;
1213

1314
namespace VirtoCommerce.Platform.Web.Controllers.Api
1415
{
@@ -34,6 +35,7 @@ public OAuthAppsController(OpenIddictApplicationManager<OpenIddictEntityFramewor
3435

3536
[HttpGet]
3637
[Route("new")]
38+
[Authorize(Permissions.SecurityOAuthApplicationsCreate)]
3739
public ActionResult<OpenIddictApplicationDescriptor> New()
3840
{
3941
var app = new OpenIddictApplicationDescriptor
@@ -50,6 +52,7 @@ public ActionResult<OpenIddictApplicationDescriptor> New()
5052

5153
[HttpPost]
5254
[Route("")]
55+
[Authorize(Permissions.SecurityOAuthApplicationsUpdate)]
5356
public async Task<ActionResult<OpenIddictApplicationDescriptor>> SaveAsync(OpenIddictApplicationDescriptor descriptor)
5457
{
5558
descriptor.Permissions.Clear();
@@ -77,6 +80,7 @@ public async Task<ActionResult<OpenIddictApplicationDescriptor>> SaveAsync(OpenI
7780

7881
[HttpDelete]
7982
[Route("")]
83+
[Authorize(Permissions.SecurityOAuthApplicationsDelete)]
8084
public async Task<ActionResult> DeleteAsync([FromQuery] string[] clientIds)
8185
{
8286
var apps = await _manager.ListAsync(x => x.Where(y => clientIds.Contains(y.ClientId))).ToListAsync();
@@ -91,6 +95,7 @@ public async Task<ActionResult> DeleteAsync([FromQuery] string[] clientIds)
9195

9296
[HttpPost]
9397
[Route("search")]
98+
[Authorize(Permissions.SecurityOAuthApplicationsRead)]
9499
public async Task<ActionResult<OAuthAppSearchResult>> SearchAsync(OAuthAppSearchCriteria criteria)
95100
{
96101
if (criteria.Sort.IsNullOrEmpty())

‎src/VirtoCommerce.Platform.Web/Controllers/Api/PlatformExportImportController.cs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,13 +119,15 @@ public ActionResult<SampleDataState> GetSampleDataState()
119119

120120
[HttpGet]
121121
[Route("export/manifest/new")]
122+
[Authorize(Permissions.PlatformExport)]
122123
public ActionResult<PlatformExportManifest> GetNewExportManifest()
123124
{
124125
return Ok(_platformExportManager.GetNewExportManifest(_userNameResolver.GetCurrentUserName()));
125126
}
126127

127128
[HttpGet]
128129
[Route("export/manifest/load")]
130+
[Authorize(Permissions.PlatformImport)]
129131
public ActionResult<PlatformExportManifest> LoadExportManifest([FromQuery] string fileUrl)
130132
{
131133
if (string.IsNullOrEmpty(fileUrl))

0 commit comments

Comments
 (0)