Continue to construct feature and tests.

1 files changed, 56 insertions, 10 deletions

diff --git a/Timeline/Filters/User.cs b/Timeline/Filters/User.cs
index 22fae938..16c76750 100644
--- a/Timeline/Filters/User.cs
+++ b/Timeline/Filters/User.cs
@@ -1,7 +1,13 @@
-using Microsoft.AspNetCore.Mvc;

+using Microsoft.AspNetCore.Http;

+using Microsoft.AspNetCore.Mvc;

 using Microsoft.AspNetCore.Mvc.Filters;

+using Microsoft.Extensions.DependencyInjection;

+using Microsoft.Extensions.Logging;

 using System;

+using Timeline.Auth;

 using Timeline.Models.Http;

+using Timeline.Services;

+using static Timeline.Resources.Filters;

 

 namespace Timeline

 {

@@ -13,9 +19,10 @@ namespace Timeline
             {

                 public static class User // bbb = 101

                 {

-                    public const int NotExist = 11010001;

-                }

+                    public const int NotExist = 11010101;

 

+                    public const int NotSelfOrAdminForbid = 11010201;

+                }

             }

         }

     }

@@ -23,20 +30,59 @@ namespace Timeline
 

 namespace Timeline.Filters

 {

+    public class SelfOrAdminAttribute : ActionFilterAttribute

+    {

+        [System.Diagnostics.CodeAnalysis.SuppressMessage("Design", "CA1062:Validate arguments of public methods")]

+        public override void OnActionExecuting(ActionExecutingContext context)

+        {

+            var logger = context.HttpContext.RequestServices.GetRequiredService<ILogger<SelfOrAdminAttribute>>();

+

+            var user = context.HttpContext.User;

+

+            if (user == null)

+            {

+                logger.LogError(LogSelfOrAdminNoUser);

+                return;

+            }

+

+            if (context.ModelState.TryGetValue("username", out var model))

+            {

+                if (model.RawValue is string username)

+                {

+                    if (!user.IsAdministrator() && user.Identity.Name != username)

+                    {

+                        context.Result = new ObjectResult(

+                            new CommonResponse(ErrorCodes.Http.Filter.User.NotSelfOrAdminForbid, MessageSelfOrAdminForbid))

+                        { StatusCode = StatusCodes.Status403Forbidden };

+                    }

+                }

+                else

+                {

+                    logger.LogError(LogSelfOrAdminUsernameNotString);

+                }

+            }

+            else

+            {

+                logger.LogError(LogSelfOrAdminNoUsername);

+            }

+        }

+    }

+

     [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]

     public class CatchUserNotExistExceptionAttribute : ExceptionFilterAttribute

     {

         [System.Diagnostics.CodeAnalysis.SuppressMessage("Design", "CA1062:Validate arguments of public methods", Justification = "ASP.Net already checked.")]

         public override void OnException(ExceptionContext context)

         {

-            var body = new CommonResponse(

-                ErrorCodes.Http.Filter.User.NotExist,

-                Resources.Filters.MessageUserNotExist);

+            if (context.Exception is UserNotExistException)

+            {

+                var body = new CommonResponse(ErrorCodes.Http.Filter.User.NotExist, MessageUserNotExist);

 

-            if (context.HttpContext.Request.Method == "GET")

-                context.Result = new NotFoundObjectResult(body);

-            else

-                context.Result = new BadRequestObjectResult(body);

+                if (context.HttpContext.Request.Method == "GET")

+                    context.Result = new NotFoundObjectResult(body);

+                else

+                    context.Result = new BadRequestObjectResult(body);

+            }

         }

     }

 }