...

4 files changed, 28 insertions, 27 deletions

diff --git a/BackEnd/Timeline/Controllers/ControllerAuthExtensions.cs b/BackEnd/Timeline/Controllers/ControllerAuthExtensions.cs
index 00a65454..9096978d 100644
--- a/BackEnd/Timeline/Controllers/ControllerAuthExtensions.cs
+++ b/BackEnd/Timeline/Controllers/ControllerAuthExtensions.cs
@@ -2,15 +2,16 @@
 using System;

 using System.Security.Claims;

 using Timeline.Auth;

+using Timeline.Services;

 using static Timeline.Resources.Controllers.ControllerAuthExtensions;

 

 namespace Timeline.Controllers

 {

     public static class ControllerAuthExtensions

     {

-        public static bool IsAdministrator(this ControllerBase controller)

+        public static bool UserHasPermission(this ControllerBase controller, UserPermission permission)

         {

-            return controller.User != null && controller.User.IsAdministrator();

+            return controller.User != null && controller.User.HasPermission(permission);

         }

 

         public static long GetUserId(this ControllerBase controller)

diff --git a/BackEnd/Timeline/Controllers/TimelineController.cs b/BackEnd/Timeline/Controllers/TimelineController.cs
index 9a3147ea..45060b5d 100644
--- a/BackEnd/Timeline/Controllers/TimelineController.cs
+++ b/BackEnd/Timeline/Controllers/TimelineController.cs
@@ -43,6 +43,8 @@ namespace Timeline.Controllers
             _mapper = mapper;

         }

 

+        private bool UserHasAllTimelineManagementPermission => this.UserHasPermission(UserPermission.AllTimelineManagement);

+

         /// <summary>

         /// List all timelines.

         /// </summary>

@@ -180,7 +182,7 @@ namespace Timeline.Controllers
         [ProducesResponseType(StatusCodes.Status404NotFound)]

         public async Task<ActionResult<List<TimelinePostInfo>>> PostListGet([FromRoute][GeneralTimelineName] string name, [FromQuery] DateTime? modifiedSince, [FromQuery] bool? includeDeleted)

         {

-            if (!this.IsAdministrator() && !await _service.HasReadPermission(name, this.GetOptionalUserId()))

+            if (!UserHasAllTimelineManagementPermission && !await _service.HasReadPermission(name, this.GetOptionalUserId()))

             {

                 return StatusCode(StatusCodes.Status403Forbidden, ErrorResponse.Common.Forbid());

             }

@@ -208,7 +210,7 @@ namespace Timeline.Controllers
         public async Task<IActionResult> PostDataGet([FromRoute][GeneralTimelineName] string name, [FromRoute] long id, [FromHeader(Name = "If-None-Match")] string? ifNoneMatch)

         {

             _ = ifNoneMatch;

-            if (!this.IsAdministrator() && !await _service.HasReadPermission(name, this.GetOptionalUserId()))

+            if (!UserHasAllTimelineManagementPermission && !await _service.HasReadPermission(name, this.GetOptionalUserId()))

             {

                 return StatusCode(StatusCodes.Status403Forbidden, ErrorResponse.Common.Forbid());

             }

@@ -246,7 +248,7 @@ namespace Timeline.Controllers
         public async Task<ActionResult<TimelinePostInfo>> PostPost([FromRoute][GeneralTimelineName] string name, [FromBody] TimelinePostCreateRequest body)

         {

             var id = this.GetUserId();

-            if (!this.IsAdministrator() && !await _service.IsMemberOf(name, id))

+            if (!UserHasAllTimelineManagementPermission && !await _service.IsMemberOf(name, id))

             {

                 return StatusCode(StatusCodes.Status403Forbidden, ErrorResponse.Common.Forbid());

             }

@@ -313,7 +315,7 @@ namespace Timeline.Controllers
         [ProducesResponseType(StatusCodes.Status403Forbidden)]

         public async Task<ActionResult<CommonDeleteResponse>> PostDelete([FromRoute][GeneralTimelineName] string name, [FromRoute] long id)

         {

-            if (!this.IsAdministrator() && !await _service.HasPostModifyPermission(name, id, this.GetUserId()))

+            if (!UserHasAllTimelineManagementPermission && !await _service.HasPostModifyPermission(name, id, this.GetUserId()))

             {

                 return StatusCode(StatusCodes.Status403Forbidden, ErrorResponse.Common.Forbid());

             }

@@ -342,7 +344,7 @@ namespace Timeline.Controllers
         [ProducesResponseType(StatusCodes.Status403Forbidden)]

         public async Task<ActionResult<TimelineInfo>> TimelinePatch([FromRoute][GeneralTimelineName] string name, [FromBody] TimelinePatchRequest body)

         {

-            if (!this.IsAdministrator() && !(await _service.HasManagePermission(name, this.GetUserId())))

+            if (!UserHasAllTimelineManagementPermission && !(await _service.HasManagePermission(name, this.GetUserId())))

             {

                 return StatusCode(StatusCodes.Status403Forbidden, ErrorResponse.Common.Forbid());

             }

@@ -365,7 +367,7 @@ namespace Timeline.Controllers
         [ProducesResponseType(StatusCodes.Status403Forbidden)]

         public async Task<ActionResult> TimelineMemberPut([FromRoute][GeneralTimelineName] string name, [FromRoute][Username] string member)

         {

-            if (!this.IsAdministrator() && !(await _service.HasManagePermission(name, this.GetUserId())))

+            if (!UserHasAllTimelineManagementPermission && !(await _service.HasManagePermission(name, this.GetUserId())))

             {

                 return StatusCode(StatusCodes.Status403Forbidden, ErrorResponse.Common.Forbid());

             }

@@ -393,7 +395,7 @@ namespace Timeline.Controllers
         [ProducesResponseType(StatusCodes.Status403Forbidden)]

         public async Task<ActionResult> TimelineMemberDelete([FromRoute][GeneralTimelineName] string name, [FromRoute][Username] string member)

         {

-            if (!this.IsAdministrator() && !(await _service.HasManagePermission(name, this.GetUserId())))

+            if (!UserHasAllTimelineManagementPermission && !(await _service.HasManagePermission(name, this.GetUserId())))

             {

                 return StatusCode(StatusCodes.Status403Forbidden, ErrorResponse.Common.Forbid());

             }

@@ -448,7 +450,7 @@ namespace Timeline.Controllers
         [ProducesResponseType(StatusCodes.Status403Forbidden)]

         public async Task<ActionResult<CommonDeleteResponse>> TimelineDelete([FromRoute][TimelineName] string name)

         {

-            if (!this.IsAdministrator() && !(await _service.HasManagePermission(name, this.GetUserId())))

+            if (!UserHasAllTimelineManagementPermission && !(await _service.HasManagePermission(name, this.GetUserId())))

             {

                 return StatusCode(StatusCodes.Status403Forbidden, ErrorResponse.Common.Forbid());

             }

@@ -472,7 +474,7 @@ namespace Timeline.Controllers
         [ProducesResponseType(StatusCodes.Status403Forbidden)]

         public async Task<ActionResult<TimelineInfo>> TimelineOpChangeName([FromBody] TimelineChangeNameRequest body)

         {

-            if (!this.IsAdministrator() && !(await _service.HasManagePermission(body.OldName, this.GetUserId())))

+            if (!UserHasAllTimelineManagementPermission && !(await _service.HasManagePermission(body.OldName, this.GetUserId())))

             {

                 return StatusCode(StatusCodes.Status403Forbidden, ErrorResponse.Common.Forbid());

             }

diff --git a/BackEnd/Timeline/Controllers/UserAvatarController.cs b/BackEnd/Timeline/Controllers/UserAvatarController.cs
index bc4afa30..44d45b76 100644
--- a/BackEnd/Timeline/Controllers/UserAvatarController.cs
+++ b/BackEnd/Timeline/Controllers/UserAvatarController.cs
@@ -86,7 +86,7 @@ namespace Timeline.Controllers
         [ProducesResponseType(StatusCodes.Status403Forbidden)]

         public async Task<IActionResult> Put([FromRoute][Username] string username, [FromBody] ByteData body)

         {

-            if (!User.IsAdministrator() && User.Identity.Name != username)

+            if (!this.UserHasPermission(UserPermission.UserManagement) && User.Identity!.Name != username)

             {

                 _logger.LogInformation(Log.Format(LogPutForbid,

                     ("Operator Username", User.Identity.Name), ("Username To Put Avatar", username)));

@@ -149,10 +149,10 @@ namespace Timeline.Controllers
         [Authorize]

         public async Task<IActionResult> Delete([FromRoute][Username] string username)

         {

-            if (!User.IsAdministrator() && User.Identity.Name != username)

+            if (!this.UserHasPermission(UserPermission.UserManagement) && User.Identity!.Name != username)

             {

                 _logger.LogInformation(Log.Format(LogDeleteForbid,

-                    ("Operator Username", User.Identity.Name), ("Username To Delete Avatar", username)));

+                    ("Operator Username", User.Identity!.Name), ("Username To Delete Avatar", username)));

                 return StatusCode(StatusCodes.Status403Forbidden, ErrorResponse.Common.Forbid());

             }

 

diff --git a/BackEnd/Timeline/Controllers/UserController.cs b/BackEnd/Timeline/Controllers/UserController.cs
index 02c09aab..524e5559 100644
--- a/BackEnd/Timeline/Controllers/UserController.cs
+++ b/BackEnd/Timeline/Controllers/UserController.cs
@@ -65,7 +65,8 @@ namespace Timeline.Controllers
         {

             try

             {

-                var user = await _userService.GetUserByUsername(username);

+                var id = await _userService.GetUserIdByUsername(username);

+                var user = await _userService.GetUser(id);

                 return Ok(ConvertToUserInfo(user));

             }

             catch (UserNotExistException e)

@@ -89,11 +90,12 @@ namespace Timeline.Controllers
         [ProducesResponseType(StatusCodes.Status404NotFound)]

         public async Task<ActionResult<UserInfo>> Patch([FromBody] UserPatchRequest body, [FromRoute][Username] string username)

         {

-            if (this.IsAdministrator())

+            if (this.UserHasPermission(UserPermission.UserManagement))

             {

                 try

                 {

-                    var user = await _userService.ModifyUser(username, _mapper.Map<User>(body));

+                    var id = await _userService.GetUserIdByUsername(username);

+                    var user = await _userService.ModifyUser(id, _mapper.Map<ModifyUserParams>(body));

                     return Ok(ConvertToUserInfo(user));

                 }

                 catch (UserNotExistException e)

@@ -108,7 +110,7 @@ namespace Timeline.Controllers
             }

             else

             {

-                if (User.Identity.Name != username)

+                if (User.Identity!.Name != username)

                     return StatusCode(StatusCodes.Status403Forbidden,

                         ErrorResponse.Common.CustomMessage_Forbid(Common_Forbid_NotSelf));

 

@@ -120,11 +122,7 @@ namespace Timeline.Controllers
                     return StatusCode(StatusCodes.Status403Forbidden,

                         ErrorResponse.Common.CustomMessage_Forbid(UserController_Patch_Forbid_Password));

 

-                if (body.Administrator != null)

-                    return StatusCode(StatusCodes.Status403Forbidden,

-                        ErrorResponse.Common.CustomMessage_Forbid(UserController_Patch_Forbid_Administrator));

-

-                var user = await _userService.ModifyUser(this.GetUserId(), _mapper.Map<User>(body));

+                var user = await _userService.ModifyUser(this.GetUserId(), _mapper.Map<ModifyUserParams>(body));

                 return Ok(ConvertToUserInfo(user));

             }

         }

@@ -134,7 +132,7 @@ namespace Timeline.Controllers
         /// </summary>

         /// <param name="username">Username of the user to delete.</param>

         /// <returns>Info of deletion.</returns>

-        [HttpDelete("users/{username}"), AdminAuthorize]

+        [HttpDelete("users/{username}"), PermissionAuthorize(UserPermission.UserManagement)]

         [ProducesResponseType(StatusCodes.Status200OK)]

         [ProducesResponseType(StatusCodes.Status401Unauthorized)]

         [ProducesResponseType(StatusCodes.Status403Forbidden)]

@@ -151,7 +149,7 @@ namespace Timeline.Controllers
         /// Create a new user. You have to be administrator.

         /// </summary>

         /// <returns>The new user's info.</returns>

-        [HttpPost("userop/createuser"), AdminAuthorize]

+        [HttpPost("userop/createuser"), PermissionAuthorize(UserPermission.UserManagement)]

         [ProducesResponseType(StatusCodes.Status200OK)]

         [ProducesResponseType(StatusCodes.Status400BadRequest)]

         [ProducesResponseType(StatusCodes.Status401Unauthorized)]

@@ -160,7 +158,7 @@ namespace Timeline.Controllers
         {

             try

             {

-                var user = await _userService.CreateUser(_mapper.Map<User>(body));

+                var user = await _userService.CreateUser(body.Username, body.Password);

                 return Ok(ConvertToUserInfo(user));

             }

             catch (EntityAlreadyExistException e) when (e.EntityName == EntityNames.User)

@@ -186,7 +184,7 @@ namespace Timeline.Controllers
             catch (BadPasswordException e)

             {

                 _logger.LogInformation(e, Log.Format(LogChangePasswordBadPassword,

-                    ("Username", User.Identity.Name), ("Old Password", request.OldPassword)));

+                    ("Username", User.Identity!.Name), ("Old Password", request.OldPassword)));

                 return BadRequest(ErrorResponse.UserController.ChangePassword_BadOldPassword());

             }

             // User can't be non-existent or the token is bad.