From 71f0fa17d1fcdfd7bb1f92993e60a168acbf4b53 Mon Sep 17 00:00:00 2001 From: support Date: Sun, 18 Oct 2026 08:05:32 +0200 Subject: [PATCH 1/3] Move the request-customer Authorize overloads to Web IPermissionService (Business) now only authorizes a customer the caller passes in, and PermissionService no longer takes IContextAccessor. The new IRequestPermissionService : IPermissionService in Grand.Web.Common.Security.Authorization adds Authorize(Permission) and Authorize(string) for the customer of the current request. Web, the admin panels, Razor views, filters and plugins inject it; the calls are unchanged. Grand.Module.Api has no Web.Common reference, so its controllers and AuthorizeApiAdminAttribute pass WorkContext.CurrentCustomer explicitly. Authorize(string, Customer) returns false for a null customer instead of throwing, matching Authorize(Permission, Customer). Breaking for external plugins that call the single-argument overloads through IPermissionService. --- .ai/knowledge/admin-areas.md | 2 +- .ai/knowledge/security.md | 8 ++- .ai/skills/permission-navigation.md | 5 +- .../Services/Security/PermissionService.cs | 36 +--------- .../Common/Security/IPermissionService.cs | 22 ------ .../Controllers/BrandController.cs | 17 +++-- .../Controllers/BrandLayoutController.cs | 9 ++- .../Controllers/CategoryController.cs | 17 +++-- .../Controllers/CategoryLayoutController.cs | 9 ++- .../Controllers/CollectionController.cs | 17 +++-- .../Controllers/CollectionLayoutController.cs | 9 ++- .../Controllers/CountryController.cs | 9 ++- .../Controllers/CurrencyController.cs | 9 ++- .../Controllers/CustomerController.cs | 21 +++--- .../Controllers/CustomerGroupController.cs | 17 +++-- .../Controllers/DeliveryDateController.cs | 9 ++- .../Controllers/LanguageController.cs | 9 ++- .../Controllers/PickupPointController.cs | 9 ++- .../Controllers/PictureController.cs | 13 ++-- .../Controllers/ProductAttributeController.cs | 17 +++-- .../Controllers/ProductController.cs | 55 ++++++++------- .../Controllers/ProductLayoutController.cs | 9 ++- .../Controllers/ShippingMethodController.cs | 9 ++- .../SpecificationAttributeController.cs | 17 +++-- .../Controllers/StoreController.cs | 9 ++- .../Controllers/VendorController.cs | 9 ++- .../Controllers/WarehouseController.cs | 9 ++- .../Filters/AuthorizeApiAdminAttribute.cs | 6 +- ...acebookAuthenticationSettingsController.cs | 5 +- .../GoogleAuthenticationSettingsController.cs | 5 +- .../OidcLoginSettingsController.cs | 5 +- .../DiscountRulesCustomerGroupsController.cs | 6 +- .../DiscountRulesHadSpentAmountController.cs | 6 +- .../DiscountRulesHasAllProductsController.cs | 6 +- .../DiscountRulesHasOneProductController.cs | 6 +- ...scountRulesShoppingCartAmountController.cs | 6 +- .../Controllers/StripeCheckoutController.cs | 5 +- .../ShippingFixedRateController.cs | 6 +- .../Security/PermissionServiceTests.cs | 18 ++--- .../AuthorizeApiAdminAttributeTests.cs | 15 ++-- .../Components/AdminPageViewComponentTests.cs | 6 +- .../BaseCustomerControllerTests.cs | 6 +- .../BaseCustomerManagementControllerTests.cs | 8 +-- .../BaseFullReportsControllerTests.cs | 8 +-- .../Controllers/BasePictureControllerTests.cs | 8 +-- .../Controllers/BaseProductControllerTests.cs | 10 +-- .../RequestPermissionServiceTests.cs | 69 +++++++++++++++++++ .../Controllers/ProductControllerTests.cs | 4 +- .../Controllers/ContentPreviewTests.cs | 5 +- .../UpdateQuantityValidatorTests.cs | 4 +- .../Shared/EditorTemplates/Editor.cshtml | 4 +- .../CreateOrUpdate.TabActivityLog.cshtml | 4 +- .../Partials/CreateOrUpdate.cshtml | 4 +- .../Areas/Admin/Views/Home/Index.cshtml | 4 +- .../Areas/Admin/Views/Home/Statistics.cshtml | 4 +- .../Admin/Views/Shared/Partials/Menu.cshtml | 4 +- .../Admin/Views/Shared/_AdminLayout.cshtml | 4 +- .../Vendor/Partials/CreateOrUpdate.cshtml | 4 +- .../Grand.Web.Admin/Components/AdminPage.cs | 6 +- .../BestsellersBriefReportByAmount.cs | 8 +-- .../BestsellersBriefReportByQuantity.cs | 8 +-- .../Components/CustomerReportRegistered.cs | 8 +-- .../Components/CustomerReportTimeChart.cs | 8 +-- .../Grand.Web.Admin/Components/LatestOrder.cs | 8 +-- .../Components/OrderAverageReport.cs | 8 +-- .../Components/OrderIncompleteReport.cs | 8 +-- .../Components/OrderPeriodReport.cs | 8 +-- .../Components/OrderTimeChart.cs | 8 +-- .../Components/PopularSearchTermsReport.cs | 8 +-- .../Controllers/AffiliateController.cs | 7 +- .../Controllers/CustomerController.cs | 3 +- .../Controllers/ElFinderController.cs | 7 +- .../Controllers/OrderTagsController.cs | 5 +- .../Controllers/PictureController.cs | 3 +- .../Controllers/ProductController.cs | 4 +- .../Controllers/ReportsController.cs | 3 +- .../Controllers/BaseCustomerController.cs | 5 +- .../BaseCustomerManagementController.cs | 3 +- .../Controllers/BaseFullReportsController.cs | 6 +- .../Controllers/BasePictureController.cs | 3 +- .../Controllers/BaseProductController.cs | 3 +- .../CustomerGroupAclUpdateValidator.cs | 4 +- .../Brand/Partials/CreateOrUpdate.cshtml | 4 +- .../Category/Partials/CreateOrUpdate.cshtml | 4 +- .../Collection/Partials/CreateOrUpdate.cshtml | 4 +- .../Customer/Partials/CreateOrUpdate.cshtml | 4 +- .../Partials/CreateOrUpdate.cshtml | 4 +- .../Views/AdminShared/Order/Edit.cshtml | 4 +- .../Partials/OrderDetails.Shipment.cshtml | 4 +- .../Product/Partials/Tab.Documents.cshtml | 4 +- .../Shipment/ShipmentDetails.cshtml | 4 +- .../Filters/AuthorizeAdminAttribute.cs | 4 +- .../Filters/AuthorizeAdminOrStoreAttribute.cs | 4 +- .../Filters/AuthorizeStoreAttribute.cs | 4 +- .../Filters/AuthorizeVendorAttribute.cs | 4 +- .../Filters/ClosedStoreAttribute.cs | 4 +- .../Filters/PublicStoreAttribute.cs | 6 +- src/Web/Grand.Web.Common/Menu/SiteMap.cs | 8 +-- .../IRequestPermissionService.cs | 24 +++++++ .../PermissionAuthorizeActionAttribute.cs | 5 +- .../PermissionAuthorizeAttribute.cs | 5 +- .../Authorization/RequestPermissionService.cs | 28 ++++++++ .../Startup/StartupApplication.cs | 2 + .../Areas/Store/Views/Home/Index.cshtml | 4 +- .../Store/Views/Shared/Partials/Menu.cshtml | 4 +- .../StoreBestsellersBriefReportByAmount.cs | 8 +-- .../StoreBestsellersBriefReportByQuantity.cs | 8 +-- .../StoreCustomerReportRegistered.cs | 8 +-- .../StoreCustomerReportTimeChart.cs | 8 +-- .../Components/StoreLatestOrder.cs | 8 +-- .../Components/StoreOrderAverageReport.cs | 8 +-- .../Components/StoreOrderIncompleteReport.cs | 8 +-- .../Components/StoreOrderPeriodReport.cs | 8 +-- .../Components/StoreOrderTimeChart.cs | 8 +-- .../Controllers/PictureController.cs | 4 +- .../Controllers/ProductController.cs | 4 +- .../Controllers/ReportsController.cs | 3 +- .../Vendor/Views/Shared/Partials/Menu.cshtml | 4 +- .../Components/LatestVendorOrder.cs | 8 +-- .../Controllers/ProductController.cs | 4 +- src/Web/Grand.Web/Components/EmailWishlist.cs | 6 +- src/Web/Grand.Web/Components/Footer.cs | 6 +- .../Grand.Web/Controllers/BlogController.cs | 3 +- .../Controllers/KnowledgebaseController.cs | 5 +- .../Grand.Web/Controllers/NewsController.cs | 5 +- .../Grand.Web/Controllers/PageController.cs | 8 +-- .../Controllers/ShoppingCartController.cs | 6 +- .../Controllers/WishlistController.cs | 6 +- ...GetProductDetailsAttributeChangeHandler.cs | 6 +- .../Products/GetProductDetailsPageHandler.cs | 6 +- .../ShoppingCart/GetShoppingCartHandler.cs | 6 +- .../ShoppingCart/GetWishlistHandler.cs | 6 +- .../ShoppingCart/UpdateQuantityValidator.cs | 4 +- .../Views/Shared/Partials/HeaderLinks.cshtml | 4 +- .../Shared/Partials/ShoppingCartLinks.cshtml | 4 +- .../Shared/Partials/SidebarPanels.cshtml | 4 +- 136 files changed, 622 insertions(+), 482 deletions(-) create mode 100644 src/Tests/Grand.Web.Common.Tests/Security/Authorization/RequestPermissionServiceTests.cs create mode 100644 src/Web/Grand.Web.Common/Security/Authorization/IRequestPermissionService.cs create mode 100644 src/Web/Grand.Web.Common/Security/Authorization/RequestPermissionService.cs diff --git a/.ai/knowledge/admin-areas.md b/.ai/knowledge/admin-areas.md index 88d8bf774e..35b679ee3d 100644 --- a/.ai/knowledge/admin-areas.md +++ b/.ai/knowledge/admin-areas.md @@ -65,7 +65,7 @@ Use existing permission patterns from nearby controllers. Check: - `StandardPermission` usage -- `_permissionService.Authorize(...)` +- `_permissionService.Authorize(...)` (`IRequestPermissionService`) - area-specific access checks - menu permission names in `src/Modules/Grand.Module.Installer/Utilities/StandardAdminSiteMap.cs` - seeded permission names in installer utilities when adding new management areas diff --git a/.ai/knowledge/security.md b/.ai/knowledge/security.md index c8a2c47e99..42694d94fd 100644 --- a/.ai/knowledge/security.md +++ b/.ai/knowledge/security.md @@ -8,12 +8,14 @@ Patterns from `Grand.Web`, `Grand.Module.Api`, `Grand.Business.*`. Complementary ### Check permission before touching data -Every API and admin controller action must enforce permissions (either via `[PermissionAuthorize]` / `[PermissionAuthorizeAction]` attributes or explicit `IPermissionService.Authorize` checks) before returning any data or performing any mutation. +Every API and admin controller action must enforce permissions (either via `[PermissionAuthorize]` / `[PermissionAuthorizeAction]` attributes or explicit `Authorize` checks) before returning any data or performing any mutation. + +`IPermissionService` (Business) only authorizes a customer you pass in. Code in Web, the admin panels and plugins injects `IRequestPermissionService` (`Grand.Web.Common.Security.Authorization`), which adds `Authorize(permission)` for the customer of the current request. `Grand.Module.Api` has no Web.Common reference, so its controllers pass `_contextAccessor.WorkContext.CurrentCustomer`. Code in `src/Business` never authorizes "the current customer". ```csharp public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Brands)) + if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); @@ -110,7 +112,7 @@ Never commit connection strings, API keys, or credentials to source. Use `appset ## Summary Checklist -- [ ] Every action checks `IPermissionService.Authorize` before data access +- [ ] Every action checks a permission (attribute or `Authorize`) before data access - [ ] Returns `Forbid()` not `Unauthorized()` for permission failures - [ ] Business rule validation uses FluentValidation with record input types - [ ] Service entry points guard null arguments with `ArgumentNullException.ThrowIfNull` diff --git a/.ai/skills/permission-navigation.md b/.ai/skills/permission-navigation.md index a5ca78ae44..8d3e16edb9 100644 --- a/.ai/skills/permission-navigation.md +++ b/.ai/skills/permission-navigation.md @@ -47,7 +47,7 @@ Do not use this skill as the primary review for MongoDB query safety or authenti 10. Ensure Store Owner controllers inherit from `BaseStoreController` (it already applies `[AuthorizeStore]`) to enforce store panel access. 11. Apply `[PermissionAuthorize(PermissionSystemName.X)]` at class level on Admin, Store, or Vendor controllers to gate the entire controller on a specific feature permission. This must come after the panel-level attribute. 12. Apply `[PermissionAuthorizeAction(PermissionActionName.X)]` at action method level to enforce granular action gating within a controller that already carries `[PermissionAuthorize(...)]`. This checks both the class-level permission and the named action. -13. Never substitute `IPermissionService.Authorize(...)` in a controller action for the attribute-based approach unless the check is conditional on runtime data. Attribute checks run before the action body executes. +13. Never substitute `IRequestPermissionService.Authorize(...)` in a controller action for the attribute-based approach unless the check is conditional on runtime data. Attribute checks run before the action body executes. #### Admin Sitemap (Navigation) 14. Add a new `AdminSiteMap` entry to `StandardAdminSiteMap.SiteMap` in `src/Modules/Grand.Module.Installer/Utilities/StandardAdminSiteMap.cs` for new installations. Set: @@ -133,7 +133,8 @@ public class AdminSiteMap : BaseEntity { | DefaultPermission entity | `src/Core/Grand.Domain/Permissions/DefaultPermission.cs` | | IPermissionProvider interface | `src/Business/Grand.Business.Core/Interfaces/Common/Security/IPermissionProvider.cs` | | PermissionProvider implementation | `src/Business/Grand.Business.Common/Services/Security/PermissionProvider.cs` | -| IPermissionService interface | `src/Business/Grand.Business.Core/Interfaces/Common/Security/IPermissionService.cs` | +| IPermissionService interface (explicit customer) | `src/Business/Grand.Business.Core/Interfaces/Common/Security/IPermissionService.cs` | +| IRequestPermissionService (customer of the request) | `src/Web/Grand.Web.Common/Security/Authorization/IRequestPermissionService.cs` | | AuthorizeAdmin attribute | `src/Web/Grand.Web.Common/Filters/AuthorizeAdminAttribute.cs` | | AuthorizeVendor attribute | `src/Web/Grand.Web.Common/Filters/AuthorizeVendorAttribute.cs` | | AuthorizeStore attribute | `src/Web/Grand.Web.Common/Filters/AuthorizeStoreAttribute.cs` | diff --git a/src/Business/Grand.Business.Common/Services/Security/PermissionService.cs b/src/Business/Grand.Business.Common/Services/Security/PermissionService.cs index 361fa9b507..9197c4040e 100644 --- a/src/Business/Grand.Business.Common/Services/Security/PermissionService.cs +++ b/src/Business/Grand.Business.Common/Services/Security/PermissionService.cs @@ -3,7 +3,6 @@ using Grand.Data; using Grand.Domain.Customers; using Grand.Domain.Permissions; -using Grand.Infrastructure; using Grand.Infrastructure.Caching; using Grand.Infrastructure.Caching.Constants; @@ -21,19 +20,16 @@ public class PermissionService : IPermissionService /// /// Permission repository /// Permission action repository - /// Work context /// Group service /// Cache manager public PermissionService( IRepository permissionRepository, IRepository permissionActionRepository, - IContextAccessor contextAccessor, IGroupService groupService, ICacheBase cacheBase) { _permissionRepository = permissionRepository; _permissionActionRepository = permissionActionRepository; - _contextAccessor = contextAccessor; _groupService = groupService; _cacheBase = cacheBase; } @@ -69,7 +65,6 @@ await _permissionRepository.FirstOrDefaultAsync( private readonly IRepository _permissionRepository; private readonly IRepository _permissionActionRepository; - private readonly IContextAccessor _contextAccessor; private readonly IGroupService _groupService; private readonly ICacheBase _cacheBase; @@ -155,20 +150,6 @@ public virtual async Task UpdatePermission(Permission permission) await _cacheBase.RemoveByPrefix(CacheKey.PERMISSIONS_PATTERN_KEY); } - /// - /// Authorize permission - /// - /// Permission record - /// true - authorized; otherwise, false - /// - /// Reads the customer of the current request. Code that may run outside a request uses the overload that - /// takes the customer. - /// - public virtual async Task Authorize(Permission permission) - { - return await Authorize(permission, _contextAccessor.WorkContext.CurrentCustomer); - } - /// /// Authorize permission /// @@ -186,20 +167,6 @@ public virtual async Task Authorize(Permission permission, Customer custom return await Authorize(permission.SystemName, customer); } - /// - /// Authorize permission - /// - /// Permission system name - /// true - authorized; otherwise, false - /// - /// Reads the customer of the current request. Code that may run outside a request uses the overload that - /// takes the customer. - /// - public virtual async Task Authorize(string permissionSystemName) - { - return await Authorize(permissionSystemName, _contextAccessor.WorkContext.CurrentCustomer); - } - /// /// Authorize permission /// @@ -211,6 +178,9 @@ public virtual async Task Authorize(string permissionSystemName, Customer if (string.IsNullOrEmpty(permissionSystemName)) return false; + if (customer == null) + return false; + var customerGroups = await _groupService.GetAllByIds(customer.Groups.ToArray()); foreach (var group in customerGroups) if (await Authorize(permissionSystemName, group)) diff --git a/src/Business/Grand.Business.Core/Interfaces/Common/Security/IPermissionService.cs b/src/Business/Grand.Business.Core/Interfaces/Common/Security/IPermissionService.cs index 2c9341e648..508b66d165 100644 --- a/src/Business/Grand.Business.Core/Interfaces/Common/Security/IPermissionService.cs +++ b/src/Business/Grand.Business.Core/Interfaces/Common/Security/IPermissionService.cs @@ -46,17 +46,6 @@ public interface IPermissionService /// Permission Task DeletePermission(Permission permission); - /// - /// Authorize permission - /// - /// Permission - /// true - authorized; otherwise, false - /// - /// Reads the customer of the current request. Code that may run outside a request uses the overload that - /// takes the customer. - /// - Task Authorize(Permission permission); - /// /// Authorize permission /// @@ -65,17 +54,6 @@ public interface IPermissionService /// true - authorized; otherwise, false Task Authorize(Permission permission, Customer customer); - /// - /// Authorize permission - /// - /// Permission system name - /// true - authorized; otherwise, false - /// - /// Reads the customer of the current request. Code that may run outside a request uses the overload that - /// takes the customer. - /// - Task Authorize(string permissionSystemName); - /// /// Authorize permission /// diff --git a/src/Modules/Grand.Module.Api/Controllers/BrandController.cs b/src/Modules/Grand.Module.Api/Controllers/BrandController.cs index c7798196d6..00a501b6da 100644 --- a/src/Modules/Grand.Module.Api/Controllers/BrandController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/BrandController.cs @@ -10,6 +10,7 @@ using Microsoft.AspNetCore.Http; using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -17,11 +18,13 @@ public class BrandController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public BrandController(IMediator mediator, IPermissionService permissionService) + public BrandController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entities from Brand")] @@ -32,7 +35,7 @@ public BrandController(IMediator mediator, IPermissionService permissionService) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Brands)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -45,7 +48,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(BrandDto))] public async Task GetById([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Brands)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var brand = await _mediator.Send(new GetGenericQuery(key)); if (!brand.Any()) return NotFound(); @@ -61,7 +64,7 @@ public async Task GetById([FromRoute] string key) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] BrandDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Brands)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddBrandCommand { Model = model }); return Ok(model); @@ -75,7 +78,7 @@ public async Task Post([FromBody] BrandDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] BrandDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Brands)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateBrandCommand { Model = model }); return Ok(model); @@ -100,7 +103,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.Brands)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var brand = await _mediator.Send(new GetGenericQuery(key)); if (!brand.Any()) return NotFound(); @@ -119,7 +122,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Brands)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var brand = await _mediator.Send(new GetGenericQuery(key)); if (!brand.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/BrandLayoutController.cs b/src/Modules/Grand.Module.Api/Controllers/BrandLayoutController.cs index 65227d3538..4a6049cec8 100644 --- a/src/Modules/Grand.Module.Api/Controllers/BrandLayoutController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/BrandLayoutController.cs @@ -8,6 +8,7 @@ using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class BrandLayoutController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public BrandLayoutController(IMediator mediator, IPermissionService permissionService) + public BrandLayoutController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from BrandLayout by key")] @@ -30,7 +33,7 @@ public BrandLayoutController(IMediator mediator, IPermissionService permissionSe [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var layout = await _mediator.Send(new GetGenericQuery(key)); if (!layout.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/CategoryController.cs b/src/Modules/Grand.Module.Api/Controllers/CategoryController.cs index 34a4f3226d..389ed71730 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CategoryController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CategoryController.cs @@ -10,6 +10,7 @@ using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -17,13 +18,15 @@ public class CategoryController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; public CategoryController( IMediator mediator, - IPermissionService permissionService) + IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Category by key")] @@ -34,7 +37,7 @@ public CategoryController( [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Categories)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var category = await _mediator.Send(new GetGenericQuery(key)); if (!category.Any()) return NotFound(); @@ -50,7 +53,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Categories)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -63,7 +66,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] CategoryDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Categories)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddCategoryCommand { Model = model }); return Ok(model); @@ -77,7 +80,7 @@ public async Task Post([FromBody] CategoryDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] CategoryDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Categories)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateCategoryCommand { Model = model }); return Ok(model); @@ -95,7 +98,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.Categories)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var category = await _mediator.Send(new GetGenericQuery(key)); if (!category.Any()) return NotFound(); @@ -114,7 +117,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Categories)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var category = await _mediator.Send(new GetGenericQuery(key)); if (!category.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/CategoryLayoutController.cs b/src/Modules/Grand.Module.Api/Controllers/CategoryLayoutController.cs index fd993e5fbb..cb26f48eeb 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CategoryLayoutController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CategoryLayoutController.cs @@ -8,6 +8,7 @@ using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,13 +16,15 @@ public class CategoryLayoutController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; public CategoryLayoutController( IMediator mediator, - IPermissionService permissionService) + IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from CategoryLayout by key")] @@ -32,7 +35,7 @@ public CategoryLayoutController( [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var layout = await _mediator.Send(new GetGenericQuery(key)); if (!layout.Any()) return NotFound(); @@ -48,7 +51,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/CollectionController.cs b/src/Modules/Grand.Module.Api/Controllers/CollectionController.cs index 69b71d0d33..455f950d6f 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CollectionController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CollectionController.cs @@ -10,6 +10,7 @@ using Microsoft.AspNetCore.JsonPatch.SystemTextJson; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -17,11 +18,13 @@ public class CollectionController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public CollectionController(IMediator mediator, IPermissionService permissionService) + public CollectionController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Collection by key")] @@ -32,7 +35,7 @@ public CollectionController(IMediator mediator, IPermissionService permissionSer [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Collections)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var collection = await _mediator.Send(new GetGenericQuery(key)); if (!collection.Any()) return NotFound(); @@ -48,7 +51,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Collections)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -61,7 +64,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] CollectionDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Collections)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddCollectionCommand { Model = model }); return Ok(model); @@ -75,7 +78,7 @@ public async Task Post([FromBody] CollectionDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] CollectionDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Collections)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateCollectionCommand { Model = model }); return Ok(model); @@ -93,7 +96,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.Collections)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var collection = await _mediator.Send(new GetGenericQuery(key)); if (!collection.Any()) return NotFound(); @@ -112,7 +115,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Collections)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var collection = await _mediator.Send(new GetGenericQuery(key)); if (!collection.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/CollectionLayoutController.cs b/src/Modules/Grand.Module.Api/Controllers/CollectionLayoutController.cs index 55805b07bc..bf2df44cd9 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CollectionLayoutController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CollectionLayoutController.cs @@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class CollectionLayoutController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public CollectionLayoutController(IMediator mediator, IPermissionService permissionService) + public CollectionLayoutController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from CollectionLayout by key")] @@ -30,7 +33,7 @@ public CollectionLayoutController(IMediator mediator, IPermissionService permiss [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var layout = await _mediator.Send(new GetGenericQuery(key)); if (!layout.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/CountryController.cs b/src/Modules/Grand.Module.Api/Controllers/CountryController.cs index c612084937..d861eed7cf 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CountryController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CountryController.cs @@ -8,6 +8,7 @@ using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class CountryController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public CountryController(IMediator mediator, IPermissionService permissionService) + public CountryController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Country by key")] @@ -30,7 +33,7 @@ public CountryController(IMediator mediator, IPermissionService permissionServic [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Countries)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Countries, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); //Domain.Directory.Country var country = await _mediator.Send(new GetGenericQuery(key)); @@ -47,7 +50,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Countries)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Countries, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/CurrencyController.cs b/src/Modules/Grand.Module.Api/Controllers/CurrencyController.cs index 6dcfd0db31..b7f86d779a 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CurrencyController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CurrencyController.cs @@ -8,6 +8,7 @@ using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class CurrencyController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public CurrencyController(IMediator mediator, IPermissionService permissionService) + public CurrencyController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Currency by key")] @@ -30,7 +33,7 @@ public CurrencyController(IMediator mediator, IPermissionService permissionServi [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Currencies)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Currencies, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var currency = await _mediator.Send(new GetGenericQuery(key)); if (!currency.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Currencies)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Currencies, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/CustomerController.cs b/src/Modules/Grand.Module.Api/Controllers/CustomerController.cs index 0ed7c0b4c6..699bf2e431 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CustomerController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CustomerController.cs @@ -10,6 +10,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -20,10 +21,11 @@ public class CustomerController : BaseApiController private readonly CustomerSettings _customerSettings; private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; public CustomerController( IMediator mediator, - IPermissionService permissionService, + IPermissionService permissionService, IContextAccessor contextAccessor, ICustomerManagerService customerManagerService, CustomerSettings customerSettings) { @@ -31,6 +33,7 @@ public CustomerController( _customerManagerService = customerManagerService; _customerSettings = customerSettings; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Customer by email")] @@ -41,7 +44,7 @@ public CustomerController( [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string email) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var customer = await _mediator.Send(new GetCustomerQuery { Email = email }); if (customer == null) return NotFound(); @@ -57,7 +60,7 @@ public async Task Get([FromRoute] string email) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] CustomerDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddCustomerCommand { Model = model }); return Ok(model); @@ -71,7 +74,7 @@ public async Task Post([FromBody] CustomerDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] CustomerDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateCustomerCommand { Model = model }); return Ok(model); @@ -85,7 +88,7 @@ public async Task Put([FromBody] CustomerDto model) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string email) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var customer = await _mediator.Send(new GetCustomerQuery { Email = email }); if (customer == null) return NotFound(); @@ -105,7 +108,7 @@ public async Task Delete([FromRoute] string email) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task AddAddress([FromRoute] string email, [FromBody] AddressDto address) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var customer = await _mediator.Send(new GetCustomerQuery { Email = email }); if (customer == null) return NotFound(); @@ -124,7 +127,7 @@ public async Task AddAddress([FromRoute] string email, [FromBody] [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateAddress([FromRoute] string email, [FromBody] AddressDto address) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var customer = await _mediator.Send(new GetCustomerQuery { Email = email }); if (customer == null) return NotFound(); @@ -144,7 +147,7 @@ public async Task UpdateAddress([FromRoute] string email, [FromBo [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteAddress([FromRoute] string email, [FromBody] DeleteAddressDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (model == null || string.IsNullOrEmpty(model.AddressId)) return NotFound(); @@ -170,7 +173,7 @@ public async Task DeleteAddress([FromRoute] string email, [FromBo [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task SetPassword([FromRoute] string email, [FromBody] PasswordDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (model == null || string.IsNullOrEmpty(model.Password)) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/CustomerGroupController.cs b/src/Modules/Grand.Module.Api/Controllers/CustomerGroupController.cs index cecbae825e..d5321b95ad 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CustomerGroupController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CustomerGroupController.cs @@ -10,6 +10,7 @@ using Microsoft.AspNetCore.JsonPatch.SystemTextJson; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -17,11 +18,13 @@ public class CustomerGroupController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public CustomerGroupController(IMediator mediator, IPermissionService permissionService) + public CustomerGroupController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from CustomerGroup by key")] @@ -32,7 +35,7 @@ public CustomerGroupController(IMediator mediator, IPermissionService permission [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var customerGroup = await _mediator.Send(new GetGenericQuery(key)); if (!customerGroup.Any()) return NotFound(); @@ -48,7 +51,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -61,7 +64,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] CustomerGroupDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddCustomerGroupCommand { Model = model }); return Ok(model); @@ -75,7 +78,7 @@ public async Task Post([FromBody] CustomerGroupDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] CustomerGroupDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (!model.IsSystem) { @@ -98,7 +101,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var customerGroup = await _mediator.Send(new GetGenericQuery(key)); if (!customerGroup.Any()) return NotFound(); @@ -122,7 +125,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var customerGroup = await _mediator.Send(new GetGenericQuery(key)); if (!customerGroup.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/DeliveryDateController.cs b/src/Modules/Grand.Module.Api/Controllers/DeliveryDateController.cs index b586f81297..8eaf108a0c 100644 --- a/src/Modules/Grand.Module.Api/Controllers/DeliveryDateController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/DeliveryDateController.cs @@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class DeliveryDateController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public DeliveryDateController(IMediator mediator, IPermissionService permissionService) + public DeliveryDateController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Delivery Date by key")] @@ -30,7 +33,7 @@ public DeliveryDateController(IMediator mediator, IPermissionService permissionS [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var deliverydate = await _mediator.Send(new GetGenericQuery(key)); if (!deliverydate.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/LanguageController.cs b/src/Modules/Grand.Module.Api/Controllers/LanguageController.cs index b5a1ed847c..3cbf03a4cf 100644 --- a/src/Modules/Grand.Module.Api/Controllers/LanguageController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/LanguageController.cs @@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class LanguageController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public LanguageController(IMediator mediator, IPermissionService permissionService) + public LanguageController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Languages by key")] @@ -30,7 +33,7 @@ public LanguageController(IMediator mediator, IPermissionService permissionServi [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Languages)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Languages, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var language = await _mediator.Send(new GetGenericQuery(key)); if (!language.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Languages)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Languages, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/PickupPointController.cs b/src/Modules/Grand.Module.Api/Controllers/PickupPointController.cs index e5d0837a07..55d99640b6 100644 --- a/src/Modules/Grand.Module.Api/Controllers/PickupPointController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/PickupPointController.cs @@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class PickupPointController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public PickupPointController(IMediator mediator, IPermissionService permissionService) + public PickupPointController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from PickupPoint by key")] @@ -30,7 +33,7 @@ public PickupPointController(IMediator mediator, IPermissionService permissionSe [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var points = await _mediator.Send(new GetGenericQuery(key)); if (!points.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/PictureController.cs b/src/Modules/Grand.Module.Api/Controllers/PictureController.cs index fba3f73287..1a296c840b 100644 --- a/src/Modules/Grand.Module.Api/Controllers/PictureController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/PictureController.cs @@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class PictureController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public PictureController(IMediator mediator, IPermissionService permissionService) + public PictureController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entities from Picture by key")] @@ -30,7 +33,7 @@ public PictureController(IMediator mediator, IPermissionService permissionServic [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Pictures)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Pictures, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var picture = await _mediator.Send(new GetGenericQuery(key)); if (picture == null || !picture.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] PictureDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Pictures)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Pictures, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddPictureCommand { PictureDto = model }); return Ok(model); @@ -60,7 +63,7 @@ public async Task Post([FromBody] PictureDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] PictureDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Pictures)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Pictures, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var result = await _mediator.Send(new UpdatePictureCommand { Model = model }); return Ok(result); @@ -74,7 +77,7 @@ public async Task Put([FromBody] PictureDto model) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Pictures)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Pictures, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var picture = await _mediator.Send(new GetGenericQuery(key)); if (picture == null || !picture.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/ProductAttributeController.cs b/src/Modules/Grand.Module.Api/Controllers/ProductAttributeController.cs index ddebfc9646..718e3661e3 100644 --- a/src/Modules/Grand.Module.Api/Controllers/ProductAttributeController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/ProductAttributeController.cs @@ -10,6 +10,7 @@ using Microsoft.AspNetCore.JsonPatch.SystemTextJson; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -17,13 +18,15 @@ public class ProductAttributeController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; public ProductAttributeController( IMediator mediator, - IPermissionService permissionService) + IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from ProductAttribute by key")] @@ -34,7 +37,7 @@ public ProductAttributeController( [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var productAttribute = await _mediator.Send(new GetGenericQuery(key)); if (!productAttribute.Any()) return NotFound(); @@ -50,7 +53,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -63,7 +66,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] ProductAttributeDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddProductAttributeCommand { Model = model }); return Ok(model); @@ -77,7 +80,7 @@ public async Task Post([FromBody] ProductAttributeDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] ProductAttributeDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateProductAttributeCommand { Model = model }); return Ok(model); @@ -95,7 +98,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var productAttribute = await _mediator.Send(new GetGenericQuery(key)); if (!productAttribute.Any()) return NotFound(); @@ -114,7 +117,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var productAttribute = await _mediator.Send(new GetGenericQuery(key)); if (!productAttribute.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/ProductController.cs b/src/Modules/Grand.Module.Api/Controllers/ProductController.cs index 5358e0e637..40b8d6d34e 100644 --- a/src/Modules/Grand.Module.Api/Controllers/ProductController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/ProductController.cs @@ -10,6 +10,7 @@ using Microsoft.AspNetCore.JsonPatch.SystemTextJson; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -17,13 +18,15 @@ public class ProductController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; public ProductController( IMediator mediator, - IPermissionService permissionService) + IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Product by key")] @@ -34,7 +37,7 @@ public ProductController( [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var product = await _mediator.Send(new GetGenericQuery(key)); if (!product.Any()) return NotFound(); @@ -50,7 +53,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -63,7 +66,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] ProductDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddProductCommand { Model = model }); return Ok(model); @@ -77,7 +80,7 @@ public async Task Post([FromBody] ProductDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] ProductDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); await _mediator.Send(new UpdateProductCommand { Model = model }); return Ok(); @@ -92,7 +95,7 @@ public async Task Put([FromBody] ProductDto model) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Patch([FromRoute] string key, [FromBody] JsonPatchDocument model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); @@ -114,7 +117,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var product = await _mediator.Send(new GetGenericQuery(key)); if (!product.Any()) return NotFound(); @@ -135,7 +138,7 @@ public async Task Delete([FromRoute] string key) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateStock([FromRoute] string key, [FromBody] ProductUpdateStock model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var product = await _mediator.Send(new GetGenericQuery(key)); if (!product.Any()) return NotFound(); @@ -158,7 +161,7 @@ public async Task UpdateStock([FromRoute] string key, [FromBody] [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductCategory([FromRoute] string key, [FromBody] ProductCategoryDto productCategory) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productCategory == null) return BadRequest(); @@ -187,7 +190,7 @@ public async Task CreateProductCategory([FromRoute] string key, [ [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductCategory([FromRoute] string key, [FromBody] ProductCategoryDto productCategory) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productCategory == null) return BadRequest(); @@ -216,7 +219,7 @@ public async Task UpdateProductCategory([FromRoute] string key, [ [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductCategory([FromRoute] string key, [FromBody] ProductCategoryDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); @@ -254,7 +257,7 @@ public async Task DeleteProductCategory([FromRoute] string key, [ [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductCollection([FromRoute] string key, [FromBody] ProductCollectionDto productCollection) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productCollection == null) return BadRequest(); @@ -282,7 +285,7 @@ public async Task CreateProductCollection([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductCollection([FromRoute] string key, [FromBody] ProductCollectionDto productCollection) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productCollection == null) return BadRequest(); @@ -311,7 +314,7 @@ public async Task UpdateProductCollection([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductCollection([FromRoute] string key, [FromBody] ProductCollectionDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); @@ -349,7 +352,7 @@ public async Task DeleteProductCollection([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductPicture([FromRoute] string key, [FromBody] ProductPictureDto productPicture) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productPicture == null) return BadRequest(); @@ -377,7 +380,7 @@ public async Task CreateProductPicture([FromRoute] string key, [F [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductPicture([FromRoute] string key, [FromBody] ProductPictureDto productPicture) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productPicture == null) return BadRequest(); @@ -405,7 +408,7 @@ public async Task UpdateProductPicture([FromRoute] string key, [F [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductPicture([FromRoute] string key, [FromBody] ProductPictureDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); @@ -443,7 +446,7 @@ public async Task DeleteProductPicture([FromRoute] string key, [F [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductSpecification([FromRoute] string key, [FromBody] ProductSpecificationAttributeDto productSpecification) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productSpecification == null) return BadRequest(); @@ -472,7 +475,7 @@ public async Task CreateProductSpecification([FromRoute] string k [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductSpecification([FromRoute] string key, [FromBody] ProductSpecificationAttributeDto productSpecification) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productSpecification == null) return BadRequest(); @@ -501,7 +504,7 @@ public async Task UpdateProductSpecification([FromRoute] string k [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductSpecification([FromRoute] string key, [FromBody] ProductSpecificationAttributeDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); @@ -540,7 +543,7 @@ public async Task DeleteProductSpecification([FromRoute] string k [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductTierPrice([FromRoute] string key, [FromBody] ProductTierPriceDto productTierPrice) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productTierPrice == null) return BadRequest(); @@ -568,7 +571,7 @@ public async Task CreateProductTierPrice([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductTierPrice([FromRoute] string key, [FromBody] ProductTierPriceDto productTierPrice) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productTierPrice == null) return BadRequest(); @@ -596,7 +599,7 @@ public async Task UpdateProductTierPrice([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductTierPrice([FromRoute] string key, [FromBody] ProductTierPriceDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); @@ -634,7 +637,7 @@ public async Task DeleteProductTierPrice([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductAttributeMapping([FromRoute] string key, [FromBody] ProductAttributeMappingDto productAttributeMapping) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productAttributeMapping == null) return BadRequest(); @@ -663,7 +666,7 @@ public async Task CreateProductAttributeMapping([FromRoute] strin [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductAttributeMapping([FromRoute] string key, [FromBody] ProductAttributeMappingDto productAttributeMapping) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (productAttributeMapping == null) return BadRequest(); @@ -692,7 +695,7 @@ public async Task UpdateProductAttributeMapping([FromRoute] strin [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductAttributeMapping([FromRoute] string key, [FromBody] ProductAttributeMappingDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); diff --git a/src/Modules/Grand.Module.Api/Controllers/ProductLayoutController.cs b/src/Modules/Grand.Module.Api/Controllers/ProductLayoutController.cs index cac55c151c..5d4972a38a 100644 --- a/src/Modules/Grand.Module.Api/Controllers/ProductLayoutController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/ProductLayoutController.cs @@ -9,6 +9,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -18,11 +19,13 @@ public class ProductLayoutController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public ProductLayoutController(IMediator mediator, IPermissionService permissionService) + public ProductLayoutController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from ProductLayout by key")] @@ -33,7 +36,7 @@ public ProductLayoutController(IMediator mediator, IPermissionService permission [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var layout = await _mediator.Send(new GetGenericQuery(key)); if (!layout.Any()) return NotFound(); @@ -49,7 +52,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } } \ No newline at end of file diff --git a/src/Modules/Grand.Module.Api/Controllers/ShippingMethodController.cs b/src/Modules/Grand.Module.Api/Controllers/ShippingMethodController.cs index 4163a9f9d7..30814e1bce 100644 --- a/src/Modules/Grand.Module.Api/Controllers/ShippingMethodController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/ShippingMethodController.cs @@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class ShippingMethodController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public ShippingMethodController(IMediator mediator, IPermissionService permissionService) + public ShippingMethodController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from ShippingMethod by key")] @@ -30,7 +33,7 @@ public ShippingMethodController(IMediator mediator, IPermissionService permissio [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var shipping = await _mediator.Send(new GetGenericQuery(key)); if (!shipping.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/SpecificationAttributeController.cs b/src/Modules/Grand.Module.Api/Controllers/SpecificationAttributeController.cs index 5f7f4caf42..f02d151e20 100644 --- a/src/Modules/Grand.Module.Api/Controllers/SpecificationAttributeController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/SpecificationAttributeController.cs @@ -10,6 +10,7 @@ using Microsoft.AspNetCore.JsonPatch.SystemTextJson; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -17,11 +18,13 @@ public class SpecificationAttributeController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public SpecificationAttributeController(IMediator mediator, IPermissionService permissionService) + public SpecificationAttributeController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from SpecificationAttribute by key")] @@ -32,7 +35,7 @@ public SpecificationAttributeController(IMediator mediator, IPermissionService p [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var specificationAttribute = await _mediator.Send(new GetGenericQuery(key)); if (!specificationAttribute.Any()) return NotFound(); @@ -48,7 +51,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -61,7 +64,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] SpecificationAttributeDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddSpecificationAttributeCommand { Model = model }); return Ok(model); @@ -75,7 +78,7 @@ public async Task Post([FromBody] SpecificationAttributeDto model [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] SpecificationAttributeDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateSpecificationAttributeCommand { Model = model }); return Ok(model); @@ -93,7 +96,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var specification = await _mediator.Send(new GetGenericQuery(key)); if (!specification.Any()) return NotFound(); @@ -112,7 +115,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var specification = await _mediator.Send(new GetGenericQuery(key)); diff --git a/src/Modules/Grand.Module.Api/Controllers/StoreController.cs b/src/Modules/Grand.Module.Api/Controllers/StoreController.cs index 919c621bbd..058fd8d0b8 100644 --- a/src/Modules/Grand.Module.Api/Controllers/StoreController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/StoreController.cs @@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class StoreController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public StoreController(IMediator mediator, IPermissionService permissionService) + public StoreController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Store by key")] @@ -30,7 +33,7 @@ public StoreController(IMediator mediator, IPermissionService permissionService) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Stores)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Stores, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var store = await _mediator.Send(new GetGenericQuery(key)); if (!store.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Stores)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Stores, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/VendorController.cs b/src/Modules/Grand.Module.Api/Controllers/VendorController.cs index 57a36c49de..198157f144 100644 --- a/src/Modules/Grand.Module.Api/Controllers/VendorController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/VendorController.cs @@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class VendorController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public VendorController(IMediator mediator, IPermissionService permissionService) + public VendorController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Vendor by key")] @@ -30,7 +33,7 @@ public VendorController(IMediator mediator, IPermissionService permissionService [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Vendors)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Vendors, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var vendor = await _mediator.Send(new GetGenericQuery(key)); if (!vendor.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Vendors)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Vendors, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/WarehouseController.cs b/src/Modules/Grand.Module.Api/Controllers/WarehouseController.cs index 44ebe35975..105c07cac4 100644 --- a/src/Modules/Grand.Module.Api/Controllers/WarehouseController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/WarehouseController.cs @@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; +using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -15,11 +16,13 @@ public class WarehouseController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; + private readonly IContextAccessor _contextAccessor; - public WarehouseController(IMediator mediator, IPermissionService permissionService) + public WarehouseController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) { _mediator = mediator; _permissionService = permissionService; + _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Warehouse by key")] @@ -30,7 +33,7 @@ public WarehouseController(IMediator mediator, IPermissionService permissionServ [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); var warehouse = await _mediator.Send(new GetGenericQuery(key)); if (!warehouse.Any()) return NotFound(); @@ -46,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Filters/AuthorizeApiAdminAttribute.cs b/src/Modules/Grand.Module.Api/Filters/AuthorizeApiAdminAttribute.cs index 080e4ba986..bbe8ff855e 100644 --- a/src/Modules/Grand.Module.Api/Filters/AuthorizeApiAdminAttribute.cs +++ b/src/Modules/Grand.Module.Api/Filters/AuthorizeApiAdminAttribute.cs @@ -2,6 +2,7 @@ using Grand.Domain.Permissions; using Grand.Data; using Grand.Domain.Security; +using Grand.Infrastructure; using Grand.Infrastructure.Configuration; using Microsoft.AspNetCore.Authentication.JwtBearer; using Microsoft.AspNetCore.Mvc; @@ -32,7 +33,7 @@ public AuthorizeApiAdminAttribute(bool ignore = false) : base(typeof(AuthorizeAp /// Represents a filter that confirms access to the admin panel /// private class AuthorizeApiAdminFilter(bool ignoreFilter, IPermissionService permissionService, - SecuritySettings securitySettings, BackendAPIConfig backendApiConfig) : IAsyncAuthorizationFilter + IContextAccessor contextAccessor, SecuritySettings securitySettings, BackendAPIConfig backendApiConfig) : IAsyncAuthorizationFilter { #region Ctor @@ -73,7 +74,8 @@ public async Task OnAuthorizationAsync(AuthorizationFilterContext filterContext) if (filterContext.Filters.Any(filter => filter is AuthorizeApiAdminFilter)) { //authorize permission of access to the admin area - if (!await permissionService.Authorize(StandardPermission.ManageAccessAdminPanel)) + if (!await permissionService.Authorize(StandardPermission.ManageAccessAdminPanel, + contextAccessor.WorkContext.CurrentCustomer)) filterContext.Result = new ForbidResult(JwtBearerDefaults.AuthenticationScheme); //get allowed IP addresses diff --git a/src/Plugins/Authentication.Facebook/Areas/Admin/Controllers/FacebookAuthenticationSettingsController.cs b/src/Plugins/Authentication.Facebook/Areas/Admin/Controllers/FacebookAuthenticationSettingsController.cs index ec8164ca10..5d34c6717b 100644 --- a/src/Plugins/Authentication.Facebook/Areas/Admin/Controllers/FacebookAuthenticationSettingsController.cs +++ b/src/Plugins/Authentication.Facebook/Areas/Admin/Controllers/FacebookAuthenticationSettingsController.cs @@ -1,6 +1,5 @@ using Authentication.Facebook.Models; using Grand.Business.Core.Interfaces.Common.Configuration; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Web.Common.Controllers; using Grand.Web.Common.Filters; @@ -20,7 +19,7 @@ public class FacebookAuthenticationSettingsController : BasePluginController public FacebookAuthenticationSettingsController(FacebookExternalAuthSettings facebookExternalAuthSettings, IRequestTranslationService translationService, - IPermissionService permissionService, + IRequestPermissionService permissionService, ISettingService settingService, IConfiguration configuration) { @@ -37,7 +36,7 @@ public FacebookAuthenticationSettingsController(FacebookExternalAuthSettings fac private readonly FacebookExternalAuthSettings _facebookExternalAuthSettings; private readonly IRequestTranslationService _translationService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly ISettingService _settingService; private readonly IConfiguration _configuration; diff --git a/src/Plugins/Authentication.Google/Areas/Admin/Controllers/GoogleAuthenticationSettingsController.cs b/src/Plugins/Authentication.Google/Areas/Admin/Controllers/GoogleAuthenticationSettingsController.cs index 8e28609b16..76d7f77abc 100644 --- a/src/Plugins/Authentication.Google/Areas/Admin/Controllers/GoogleAuthenticationSettingsController.cs +++ b/src/Plugins/Authentication.Google/Areas/Admin/Controllers/GoogleAuthenticationSettingsController.cs @@ -1,6 +1,5 @@ using Authentication.Google.Models; using Grand.Business.Core.Interfaces.Common.Configuration; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Web.Common.Controllers; using Grand.Web.Common.Security.Authorization; @@ -18,7 +17,7 @@ public class GoogleAuthenticationSettingsController : BaseAdminPluginController public GoogleAuthenticationSettingsController( GoogleExternalAuthSettings googleExternalAuthSettings, IRequestTranslationService translationService, - IPermissionService permissionService, + IRequestPermissionService permissionService, ISettingService settingService, IConfiguration configuration) { @@ -35,7 +34,7 @@ public GoogleAuthenticationSettingsController( private readonly GoogleExternalAuthSettings _googleExternalAuthSettings; private readonly IRequestTranslationService _translationService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly ISettingService _settingService; private readonly IConfiguration _configuration; diff --git a/src/Plugins/Authentication.OpenIdConnect/Areas/Admin/Controllers/OidcLoginSettingsController.cs b/src/Plugins/Authentication.OpenIdConnect/Areas/Admin/Controllers/OidcLoginSettingsController.cs index ff7f4cfd54..586640bf3e 100644 --- a/src/Plugins/Authentication.OpenIdConnect/Areas/Admin/Controllers/OidcLoginSettingsController.cs +++ b/src/Plugins/Authentication.OpenIdConnect/Areas/Admin/Controllers/OidcLoginSettingsController.cs @@ -1,6 +1,5 @@ using Authentication.OpenIdConnect.Models; using Grand.Business.Core.Interfaces.Common.Configuration; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Infrastructure.Configuration; using Grand.Web.Common.Controllers; @@ -20,7 +19,7 @@ public OidcLoginSettingsController( OidcResourceServerConfig resourceServerConfig, OidcLoginConfig oidcLoginConfig, IRequestTranslationService translationService, - IPermissionService permissionService, + IRequestPermissionService permissionService, ISettingService settingService) { _oidcLoginSettings = oidcLoginSettings; @@ -39,7 +38,7 @@ public OidcLoginSettingsController( private readonly OidcResourceServerConfig _resourceServerConfig; private readonly OidcLoginConfig _oidcLoginConfig; private readonly IRequestTranslationService _translationService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly ISettingService _settingService; #endregion diff --git a/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesCustomerGroupsController.cs b/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesCustomerGroupsController.cs index f4c836c949..759095bc1a 100644 --- a/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesCustomerGroupsController.cs +++ b/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesCustomerGroupsController.cs @@ -1,9 +1,9 @@ using DiscountRules.Standard.Models; using Grand.Business.Core.Interfaces.Catalog.Discounts; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Domain.Discounts; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Rendering; @@ -13,12 +13,12 @@ public class DiscountRulesCustomerGroupsController : BaseDiscountRulePluginContr { private readonly IDiscountService _discountService; private readonly IGroupService _groupService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; public DiscountRulesCustomerGroupsController( IDiscountService discountService, IGroupService groupService, - IPermissionService permissionService) + IRequestPermissionService permissionService) { _discountService = discountService; _groupService = groupService; diff --git a/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHadSpentAmountController.cs b/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHadSpentAmountController.cs index 818f39afca..420c1657aa 100644 --- a/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHadSpentAmountController.cs +++ b/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHadSpentAmountController.cs @@ -1,8 +1,8 @@ using DiscountRules.Standard.Models; using Grand.Business.Core.Interfaces.Catalog.Discounts; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Domain.Discounts; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using System.Globalization; @@ -11,11 +11,11 @@ namespace DiscountRules.Standard.Controllers; public class DiscountRulesHadSpentAmountController : BaseDiscountRulePluginController { private readonly IDiscountService _discountService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; public DiscountRulesHadSpentAmountController( IDiscountService discountService, - IPermissionService permissionService) + IRequestPermissionService permissionService) { _discountService = discountService; _permissionService = permissionService; diff --git a/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHasAllProductsController.cs b/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHasAllProductsController.cs index a73ec9d378..66247bcb03 100644 --- a/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHasAllProductsController.cs +++ b/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHasAllProductsController.cs @@ -1,7 +1,6 @@ using DiscountRules.Standard.Models; using Grand.Business.Core.Interfaces.Catalog.Discounts; using Grand.Business.Core.Interfaces.Catalog.Products; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Common.Stores; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Utilities.Catalog; @@ -11,6 +10,7 @@ using Grand.Infrastructure; using Grand.Web.Common.DataSource; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Rendering; @@ -19,7 +19,7 @@ namespace DiscountRules.Standard.Controllers; public class DiscountRulesHasAllProductsController : BaseDiscountRulePluginController { private readonly IDiscountService _discountService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IProductService _productService; private readonly IStoreService _storeService; private readonly IRequestTranslationService _translationService; @@ -29,7 +29,7 @@ public class DiscountRulesHasAllProductsController : BaseDiscountRulePluginContr private string CurrentStoreId => _contextAccessor.WorkContext.CurrentCustomer.StaffStoreId; public DiscountRulesHasAllProductsController(IDiscountService discountService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IContextAccessor contextAccessor, IRequestTranslationService translationService, IStoreService storeService, diff --git a/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHasOneProductController.cs b/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHasOneProductController.cs index 18ffca75b4..6c37ec95fa 100644 --- a/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHasOneProductController.cs +++ b/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesHasOneProductController.cs @@ -1,7 +1,6 @@ using DiscountRules.Standard.Models; using Grand.Business.Core.Interfaces.Catalog.Discounts; using Grand.Business.Core.Interfaces.Catalog.Products; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Common.Stores; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Utilities.Catalog; @@ -12,6 +11,7 @@ using Grand.Infrastructure; using Grand.Web.Common.DataSource; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Rendering; @@ -20,7 +20,7 @@ namespace DiscountRules.Standard.Controllers; public class DiscountRulesHasOneProductController : BaseDiscountRulePluginController { private readonly IDiscountService _discountService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IProductService _productService; private readonly IStoreService _storeService; private readonly IRequestTranslationService _translationService; @@ -32,7 +32,7 @@ public class DiscountRulesHasOneProductController : BaseDiscountRulePluginContro private string CurrentStoreId => _contextAccessor.WorkContext.CurrentCustomer.StaffStoreId; public DiscountRulesHasOneProductController(IDiscountService discountService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IContextAccessor contextAccessor, IRequestTranslationService translationService, IStoreService storeService, diff --git a/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesShoppingCartAmountController.cs b/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesShoppingCartAmountController.cs index c047ba4efe..1b03baa60c 100644 --- a/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesShoppingCartAmountController.cs +++ b/src/Plugins/DiscountRules.Standard/Controllers/DiscountRulesShoppingCartAmountController.cs @@ -1,8 +1,8 @@ using DiscountRules.Standard.Models; using Grand.Business.Core.Interfaces.Catalog.Discounts; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Domain.Discounts; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using System.Globalization; @@ -11,10 +11,10 @@ namespace DiscountRules.Standard.Controllers; public class DiscountRulesShoppingCartAmountController : BaseDiscountRulePluginController { private readonly IDiscountService _discountService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; public DiscountRulesShoppingCartAmountController(IDiscountService discountService, - IPermissionService permissionService) + IRequestPermissionService permissionService) { _discountService = discountService; _permissionService = permissionService; diff --git a/src/Plugins/Payments.StripeCheckout/Areas/Admin/Controllers/StripeCheckoutController.cs b/src/Plugins/Payments.StripeCheckout/Areas/Admin/Controllers/StripeCheckoutController.cs index 7b20c0a847..4317eb3253 100644 --- a/src/Plugins/Payments.StripeCheckout/Areas/Admin/Controllers/StripeCheckoutController.cs +++ b/src/Plugins/Payments.StripeCheckout/Areas/Admin/Controllers/StripeCheckoutController.cs @@ -1,5 +1,4 @@ using Grand.Business.Core.Interfaces.Common.Configuration; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Web.Common.Controllers; using Grand.Web.Common.Filters; @@ -16,7 +15,7 @@ namespace Payments.StripeCheckout.Areas.Admin.Controllers; [PermissionAuthorize(PermissionSystemName.PaymentMethods)] public class StripeCheckoutController : BasePaymentController { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly ISettingService _settingService; private readonly IRequestTranslationService _translationService; private readonly IAdminStoreService _adminStoreService; @@ -24,7 +23,7 @@ public class StripeCheckoutController : BasePaymentController public StripeCheckoutController( ISettingService settingService, IRequestTranslationService translationService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IAdminStoreService adminStoreService) { _adminStoreService = adminStoreService; diff --git a/src/Plugins/Shipping.FixedRateShipping/Areas/Admin/Controllers/ShippingFixedRateController.cs b/src/Plugins/Shipping.FixedRateShipping/Areas/Admin/Controllers/ShippingFixedRateController.cs index 421375e397..df94e2f6b6 100644 --- a/src/Plugins/Shipping.FixedRateShipping/Areas/Admin/Controllers/ShippingFixedRateController.cs +++ b/src/Plugins/Shipping.FixedRateShipping/Areas/Admin/Controllers/ShippingFixedRateController.cs @@ -1,10 +1,10 @@ using Grand.Business.Core.Interfaces.Checkout.Shipping; using Grand.Business.Core.Interfaces.Common.Configuration; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Web.Common.Controllers; using Grand.Web.Common.DataSource; using Grand.Web.Common.Filters; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using Shipping.FixedRateShipping.Models; @@ -14,14 +14,14 @@ namespace Shipping.FixedRateShipping.Areas.Admin.Controllers; [AuthorizeAdmin] public class ShippingFixedRateController : BaseShippingController { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly ISettingService _settingService; private readonly IShippingMethodService _shippingMethodService; public ShippingFixedRateController( IShippingMethodService shippingMethodService, ISettingService settingService, - IPermissionService permissionService) + IRequestPermissionService permissionService) { _shippingMethodService = shippingMethodService; _settingService = settingService; diff --git a/src/Tests/Grand.Business.Common.Tests/Services/Security/PermissionServiceTests.cs b/src/Tests/Grand.Business.Common.Tests/Services/Security/PermissionServiceTests.cs index 0317a12f4e..9051d56e55 100644 --- a/src/Tests/Grand.Business.Common.Tests/Services/Security/PermissionServiceTests.cs +++ b/src/Tests/Grand.Business.Common.Tests/Services/Security/PermissionServiceTests.cs @@ -3,7 +3,6 @@ using Grand.Data; using Grand.Domain.Customers; using Grand.Domain.Permissions; -using Grand.Infrastructure; using Grand.Infrastructure.Caching; using Microsoft.VisualStudio.TestTools.UnitTesting; using Moq; @@ -18,18 +17,15 @@ public class PermissionServiceTests private Mock> _permissionActionRepositoryMock; private Mock> _permissionRepositoryMock; private PermissionService _service; - private Mock _workContextMock; [TestInitialize] public void Init() { _permissionRepositoryMock = new Mock>(); _permissionActionRepositoryMock = new Mock>(); - _workContextMock = new Mock(); _groupServiceMock = new Mock(); _cacheMock = new Mock(); _service = new PermissionService(_permissionRepositoryMock.Object, _permissionActionRepositoryMock.Object, - _workContextMock.Object, _groupServiceMock.Object, _cacheMock.Object); } @@ -39,12 +35,11 @@ public async Task Authorize_ReturnTrue() var permission = new Permission { SystemName = "permistion" }; var fakeCustomer = new Customer(); fakeCustomer.Groups.Add("group1"); - _workContextMock.Setup(c => c.WorkContext.CurrentCustomer).Returns(fakeCustomer); _cacheMock.Setup(c => c.GetAsync(It.IsAny(), It.IsAny>>())) .Returns(Task.FromResult(true)); _groupServiceMock.Setup(c => c.GetAllByIds(It.IsAny())) .Returns(Task.FromResult>(new List { new() })); - Assert.IsTrue(await _service.Authorize(permission)); + Assert.IsTrue(await _service.Authorize(permission, fakeCustomer)); } [TestMethod] @@ -53,12 +48,19 @@ public async Task Authorize_NullPermission_ReturnFalse() Permission permission = null; var fakeCustomer = new Customer(); fakeCustomer.Groups.Add("group1"); - _workContextMock.Setup(c => c.WorkContext.CurrentCustomer).Returns(fakeCustomer); _cacheMock.Setup(c => c.GetAsync(It.IsAny(), It.IsAny>>())) .Returns(Task.FromResult(true)); _groupServiceMock.Setup(c => c.GetAllByIds(It.IsAny())) .Returns(Task.FromResult>(new List { new() })); - Assert.IsFalse(await _service.Authorize(permission)); + Assert.IsFalse(await _service.Authorize(permission, fakeCustomer)); + } + + [TestMethod] + public async Task Authorize_NullCustomer_ReturnFalse() + { + Assert.IsFalse(await _service.Authorize(new Permission { SystemName = "permission" }, null)); + Assert.IsFalse(await _service.Authorize("permission", (Customer)null)); + _groupServiceMock.VerifyNoOtherCalls(); } private Customer CustomerAuthorizedFor(string groupId, PermissionAction deniedAction) diff --git a/src/Tests/Grand.Module.Api.Tests/Filters/AuthorizeApiAdminAttributeTests.cs b/src/Tests/Grand.Module.Api.Tests/Filters/AuthorizeApiAdminAttributeTests.cs index d2f86149b2..394d8a9314 100644 --- a/src/Tests/Grand.Module.Api.Tests/Filters/AuthorizeApiAdminAttributeTests.cs +++ b/src/Tests/Grand.Module.Api.Tests/Filters/AuthorizeApiAdminAttributeTests.cs @@ -1,7 +1,9 @@ using Grand.Business.Core.Interfaces.Common.Security; using Grand.Data; +using Grand.Domain.Customers; using Grand.Domain.Permissions; using Grand.Domain.Security; +using Grand.Infrastructure; using Grand.Infrastructure.Configuration; using Grand.Module.Api.Filters; using Microsoft.AspNetCore.Http; @@ -18,6 +20,8 @@ namespace Grand.Module.Api.Tests.Filters; [TestClass] public class AuthorizeApiAdminAttributeTests { + private readonly Customer _customer = new(); + private Mock _contextAccessor; private Mock _permissionService; [TestInitialize] @@ -26,15 +30,18 @@ public void Init() DataSettingsManager.Initialize(Path.Join(Path.GetTempPath(), "grand-api-tests-settings.json")); DataSettingsManager.Instance.LoadDataSettings(new DataSettings { ConnectionString = "mongodb://localhost" }); _permissionService = new Mock(); + _contextAccessor = new Mock(); + _contextAccessor.Setup(x => x.WorkContext.CurrentCustomer).Returns(_customer); } private async Task Run(bool apiEnabled, bool ignore, bool permitted) { - _permissionService.Setup(x => x.Authorize(It.IsAny())).ReturnsAsync(permitted); + _permissionService.Setup(x => x.Authorize(It.IsAny(), _customer)).ReturnsAsync(permitted); var attribute = new AuthorizeApiAdminAttribute(ignore); var filter = (IAsyncAuthorizationFilter)ActivatorUtilities.CreateInstance( new ServiceCollection() .AddSingleton(_permissionService.Object) + .AddSingleton(_contextAccessor.Object) .AddSingleton(new SecuritySettings()) .AddSingleton(new BackendAPIConfig { Enabled = apiEnabled }) .BuildServiceProvider(), @@ -52,7 +59,7 @@ public async Task ApiDisabled_Forbid() { var context = await Run(apiEnabled: false, ignore: false, permitted: true); Assert.IsInstanceOfType(context.Result); - _permissionService.Verify(x => x.Authorize(It.IsAny()), Times.Never); + _permissionService.Verify(x => x.Authorize(It.IsAny(), _customer), Times.Never); } [TestMethod] @@ -68,7 +75,7 @@ public async Task ApiEnabled_IgnoredAction_NoPermissionCheck() { var context = await Run(apiEnabled: true, ignore: true, permitted: false); Assert.IsNull(context.Result); - _permissionService.Verify(x => x.Authorize(It.IsAny()), Times.Never); + _permissionService.Verify(x => x.Authorize(It.IsAny(), _customer), Times.Never); } [TestMethod] @@ -76,7 +83,7 @@ public async Task ApiEnabled_PermissionDenied_Forbid() { var context = await Run(apiEnabled: true, ignore: false, permitted: false); Assert.IsInstanceOfType(context.Result); - _permissionService.Verify(x => x.Authorize(It.IsAny()), Times.Once); + _permissionService.Verify(x => x.Authorize(It.IsAny(), _customer), Times.Once); } [TestMethod] diff --git a/src/Tests/Grand.Web.Admin.Tests/Components/AdminPageViewComponentTests.cs b/src/Tests/Grand.Web.Admin.Tests/Components/AdminPageViewComponentTests.cs index fc826c43a1..4898df6002 100644 --- a/src/Tests/Grand.Web.Admin.Tests/Components/AdminPageViewComponentTests.cs +++ b/src/Tests/Grand.Web.Admin.Tests/Components/AdminPageViewComponentTests.cs @@ -1,5 +1,4 @@ using Grand.Business.Core.Interfaces.Cms; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Localization; using Grand.Domain.Pages; using Grand.Domain.Permissions; @@ -7,6 +6,7 @@ using Grand.Infrastructure.Security; using Grand.Web.Admin.Components; using Grand.Web.Admin.Models.Cms; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc.ViewComponents; using Microsoft.Extensions.Logging.Abstractions; using Microsoft.VisualStudio.TestTools.UnitTesting; @@ -20,7 +20,7 @@ public class AdminPageViewComponentTests private const string SystemName = "AdminPortalInfo"; private Mock _pageServiceMock; - private Mock _permissionServiceMock; + private Mock _permissionServiceMock; private Mock _sanitizerMock; private AdminPageViewComponent _component; @@ -28,7 +28,7 @@ public class AdminPageViewComponentTests public void Init() { _pageServiceMock = new Mock(); - _permissionServiceMock = new Mock(); + _permissionServiceMock = new Mock(); _sanitizerMock = new Mock(); var workContextMock = new Mock(); diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerControllerTests.cs index ed51c59742..29fcf6fce4 100644 --- a/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerControllerTests.cs +++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerControllerTests.cs @@ -1,6 +1,5 @@ using Grand.Business.Core.Interfaces.Common.Addresses; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Interfaces.Marketing.Customers; using Grand.Domain.Customers; @@ -20,6 +19,7 @@ using Microsoft.VisualStudio.TestTools.UnitTesting; using Moq; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; namespace Grand.Web.Admin.Tests.Controllers; @@ -450,7 +450,7 @@ public async Task OrderDetails_StoreScope_MismatchedStore_ReturnsEmptyNotExcepti var result = await Controller.OrderDetails("o1", orderServiceMock.Object, new Mock().Object, - new Mock().Object); + new Mock().Object); var json = result as JsonResult; var data = json.Value as DataSourceResult; @@ -461,7 +461,7 @@ public async Task OrderDetails_StoreScope_MismatchedStore_ReturnsEmptyNotExcepti public async Task OrderDetails_GlobalScope_NotFound_ThrowsArgumentException() { ScopeMock.Setup(s => s.DefaultStoreId).Returns((string)null); - var permissionServiceMock = new Mock(); + var permissionServiceMock = new Mock(); permissionServiceMock.Setup(p => p.Authorize(Grand.Domain.Permissions.StandardPermission.ManageOrders)).ReturnsAsync(true); var orderServiceMock = new Mock(); orderServiceMock.Setup(s => s.GetOrderById("missing")).ReturnsAsync((Grand.Domain.Orders.Order)null); diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerManagementControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerManagementControllerTests.cs index 184df6ed7e..7fd6b31677 100644 --- a/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerManagementControllerTests.cs +++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseCustomerManagementControllerTests.cs @@ -1,7 +1,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Common.Addresses; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Interfaces.ExportImport; using Grand.Business.Core.Interfaces.Marketing.Customers; @@ -21,6 +20,7 @@ using Microsoft.VisualStudio.TestTools.UnitTesting; using Moq; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; namespace Grand.Web.Admin.Tests.Controllers; @@ -36,7 +36,7 @@ private class TestManagementController( IAddressAttributeService addressAttributeService, IMessageProviderService messageProviderService, IGroupService groupService, IRequestTranslationService translationService, IContextAccessor contextAccessor, CustomerSettings customerSettings, IAdminDataScope scope, - IPermissionService permissionService, IExportManager exportManager) + IRequestPermissionService permissionService, IExportManager exportManager) : BaseCustomerManagementController(customerService, customerViewModelService, customerManagerService, customerProductService, productReviewService, productReviewViewModelService, productViewModelService, customerAttributeParser, customerAttributeService, addressAttributeParser, addressAttributeService, @@ -50,7 +50,7 @@ public void CheckTwoFactorEnabledWarningPublic(Customer existingCustomer, Custom private TestManagementController _controller; private Mock _customerServiceMock; private Mock _groupServiceMock; - private Mock _permissionServiceMock; + private Mock _permissionServiceMock; private Mock _contextAccessorMock; [TestInitialize] @@ -58,7 +58,7 @@ public void Setup() { _customerServiceMock = new Mock(); _groupServiceMock = new Mock(); - _permissionServiceMock = new Mock(); + _permissionServiceMock = new Mock(); _contextAccessorMock = new Mock(); var workContextMock = new Mock(); workContextMock.Setup(w => w.CurrentCustomer).Returns(new Customer { Id = "admin-self" }); diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseFullReportsControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseFullReportsControllerTests.cs index fd1e32db62..480cc63289 100644 --- a/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseFullReportsControllerTests.cs +++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseFullReportsControllerTests.cs @@ -5,7 +5,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Checkout.Orders; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Common.Stores; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Interfaces.System.Reports; @@ -21,6 +20,7 @@ using Grand.Web.AdminShared.Models.Orders; using Grand.Web.Common.DataSource; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Routing; @@ -53,7 +53,7 @@ private class TestFullReportsController( IReportDataScope scope, IOrderService orderService, ICustomerReportService customerReportService, - IPermissionService permissionService) + IRequestPermissionService permissionService) : BaseFullReportsController(orderReportService, productsReportService, customerReportViewModelService, priceFormatter, currencyService, productService, productAttributeFormatter, stockQuantityService, translationService, storeService, countryService, vendorService, dateTimeService, @@ -63,7 +63,7 @@ private class TestFullReportsController( private TestFullReportsController _controller = null!; private Mock _orderReportServiceMock = null!; private Mock _orderServiceMock = null!; - private Mock _permissionServiceMock = null!; + private Mock _permissionServiceMock = null!; private Mock _scopeMock = null!; private Mock _customerReportViewModelServiceMock = null!; private Mock _customerReportServiceMock = null!; @@ -96,7 +96,7 @@ public void Setup() _scopeMock.Setup(s => s.VendorId).Returns(""); _orderServiceMock = new Mock(); _customerReportServiceMock = new Mock(); - _permissionServiceMock = new Mock(); + _permissionServiceMock = new Mock(); _permissionServiceMock.Setup(p => p.Authorize(StandardPermission.ManageOrders)).ReturnsAsync(true); _controller = new TestFullReportsController(_orderReportServiceMock.Object, productsReportServiceMock.Object, diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/BasePictureControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/BasePictureControllerTests.cs index 832787f876..e56224c186 100644 --- a/src/Tests/Grand.Web.Admin.Tests/Controllers/BasePictureControllerTests.cs +++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/BasePictureControllerTests.cs @@ -1,9 +1,9 @@ -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Storage; using Grand.Domain.Common; using Grand.Domain.Media; using Grand.Domain.Permissions; using Grand.Web.AdminShared.Controllers; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.VisualStudio.TestTools.UnitTesting; @@ -18,13 +18,13 @@ public class BasePictureControllerTests // same pattern as BaseTaxCategoryControllerTests/BaseEmailAccountControllerTests. private class TestPictureController( IPictureService pictureService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IMediaFileStore mediaFileStore, MediaSettings mediaSettings) : BasePictureController(pictureService, permissionService, mediaFileStore, mediaSettings); private Mock _pictureServiceMock = null!; - private Mock _permissionServiceMock = null!; + private Mock _permissionServiceMock = null!; private Mock _mediaFileStoreMock = null!; private MediaSettings _mediaSettings = null!; @@ -32,7 +32,7 @@ private class TestPictureController( public void Setup() { _pictureServiceMock = new Mock(); - _permissionServiceMock = new Mock(); + _permissionServiceMock = new Mock(); _mediaFileStoreMock = new Mock(); _mediaSettings = new MediaSettings { AllowedFileTypes = ".jpg,.png" }; } diff --git a/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseProductControllerTests.cs b/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseProductControllerTests.cs index 6c86fc48d2..520a793e31 100644 --- a/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseProductControllerTests.cs +++ b/src/Tests/Grand.Web.Admin.Tests/Controllers/BaseProductControllerTests.cs @@ -2,7 +2,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Common.Directory; using Grand.Business.Core.Interfaces.Common.Localization; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.ExportImport; using Grand.Business.Core.Interfaces.Storage; using Grand.Business.Core.Utilities.Catalog; @@ -19,6 +18,7 @@ using Grand.Web.AdminShared.Models.Orders; using Grand.Web.Common.DataSource; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Routing; @@ -44,7 +44,7 @@ private class TestProductController( IProductReservationService productReservationService, IAuctionService auctionService, IDateTimeService dateTimeService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IEnumTranslationService enumTranslationService, IAdminDataScope scope) : BaseProductController(productViewModelService, productService, inventoryManageService, @@ -56,7 +56,7 @@ private class TestProductController( private Mock _productViewModelServiceMock; private Mock _translationServiceMock; private Mock> _scopeMock; - private Mock _permissionServiceMock; + private Mock _permissionServiceMock; private Mock _productReservationServiceMock; private Mock _auctionServiceMock; @@ -79,7 +79,7 @@ public void Setup() _scopeMock.Setup(s => s.ResourceKeyPrefix).Returns("Admin"); _scopeMock.Setup(s => s.DefaultStoreId).Returns((string)null); - _permissionServiceMock = new Mock(); + _permissionServiceMock = new Mock(); _permissionServiceMock.Setup(p => p.Authorize(It.IsAny())).ReturnsAsync(true); var languageServiceMock = new Mock(); @@ -2234,7 +2234,7 @@ public async Task AssociatedProductAddPopupPost_ScopeGrantsAccess_InvalidModel_R // --- Product pictures --------------------------------------------------------------------------- // ProductPictureAdd is deliberately not covered here (same rationale as Store's original // ProductControllerTests): reaching its HasAccess check requires a non-empty IFormFileCollection and - // a prior Pictures-permission check via IPermissionService, disproportionate setup for what is + // a prior Pictures-permission check via IRequestPermissionService, disproportionate setup for what is // otherwise the same one-line HasAccess condition covered everywhere else in this region. // --- ProductPictureList -------------------------------------------------------------------------- diff --git a/src/Tests/Grand.Web.Common.Tests/Security/Authorization/RequestPermissionServiceTests.cs b/src/Tests/Grand.Web.Common.Tests/Security/Authorization/RequestPermissionServiceTests.cs new file mode 100644 index 0000000000..c5c692ce3d --- /dev/null +++ b/src/Tests/Grand.Web.Common.Tests/Security/Authorization/RequestPermissionServiceTests.cs @@ -0,0 +1,69 @@ +using Grand.Business.Core.Interfaces.Common.Directory; +using Grand.Data; +using Grand.Domain.Customers; +using Grand.Domain.Permissions; +using Grand.Infrastructure; +using Grand.Infrastructure.Caching; +using Grand.Web.Common.Security.Authorization; +using Microsoft.VisualStudio.TestTools.UnitTesting; +using Moq; + +namespace Grand.Web.Common.Tests.Security.Authorization; + +[TestClass] +public class RequestPermissionServiceTests +{ + private Mock _contextAccessorMock; + private Mock _serviceMock; + private RequestPermissionService _service; + + [TestInitialize] + public void Init() + { + _contextAccessorMock = new Mock(); + _serviceMock = new Mock(Mock.Of>(), + Mock.Of>(), Mock.Of(), Mock.Of(), + _contextAccessorMock.Object) { CallBase = true }; + _service = _serviceMock.Object; + } + + [TestMethod] + public async Task Authorize_SystemName_UsesCustomerOfTheRequest() + { + var customer = new Customer(); + _contextAccessorMock.Setup(c => c.WorkContext.CurrentCustomer).Returns(customer); + _serviceMock.Setup(x => x.Authorize("ManageProducts", customer)).ReturnsAsync(true); + + Assert.IsTrue(await _service.Authorize("ManageProducts")); + } + + [TestMethod] + public async Task Authorize_Permission_UsesCustomerOfTheRequest() + { + var customer = new Customer(); + var permission = new Permission { SystemName = "ManageProducts" }; + _contextAccessorMock.Setup(c => c.WorkContext.CurrentCustomer).Returns(customer); + _serviceMock.Setup(x => x.Authorize(permission, customer)).ReturnsAsync(true); + + Assert.IsTrue(await _service.Authorize(permission)); + } + + [TestMethod] + public async Task Authorize_WithoutWorkContext_ReturnsFalse() + { + _contextAccessorMock.Setup(c => c.WorkContext).Returns((IWorkContext)null); + + Assert.IsFalse(await _service.Authorize("ManageProducts")); + Assert.IsFalse(await _service.Authorize(new Permission { SystemName = "ManageProducts" })); + } + + [TestMethod] + public async Task Authorize_WithCustomer_DoesNotReadTheRequest() + { + var customer = new Customer(); + _serviceMock.Setup(x => x.Authorize("ManageProducts", customer)).ReturnsAsync(true); + + Assert.IsTrue(await _service.Authorize("ManageProducts", customer)); + _contextAccessorMock.VerifyNoOtherCalls(); + } +} diff --git a/src/Tests/Grand.Web.Store.Tests/Controllers/ProductControllerTests.cs b/src/Tests/Grand.Web.Store.Tests/Controllers/ProductControllerTests.cs index bbcdd4d690..365735cc45 100644 --- a/src/Tests/Grand.Web.Store.Tests/Controllers/ProductControllerTests.cs +++ b/src/Tests/Grand.Web.Store.Tests/Controllers/ProductControllerTests.cs @@ -1,12 +1,12 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Common.Directory; using Grand.Business.Core.Interfaces.Common.Localization; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Catalog; using Grand.Domain.Customers; using Grand.Infrastructure; using Grand.Web.AdminShared.Interfaces; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Store.Controllers; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc.ViewFeatures; @@ -54,7 +54,7 @@ public void Setup() new Mock().Object, new Mock().Object, new Mock().Object, - new Mock().Object, + new Mock().Object, new Mock().Object, _scopeMock.Object); diff --git a/src/Tests/Grand.Web.Tests/Controllers/ContentPreviewTests.cs b/src/Tests/Grand.Web.Tests/Controllers/ContentPreviewTests.cs index 19350d6d3c..8d86ba439a 100644 --- a/src/Tests/Grand.Web.Tests/Controllers/ContentPreviewTests.cs +++ b/src/Tests/Grand.Web.Tests/Controllers/ContentPreviewTests.cs @@ -14,6 +14,7 @@ using Grand.Infrastructure; using Grand.Infrastructure.Caching; using Grand.Mediator; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Controllers; using Grand.Web.Features.Handlers.Pages; using Grand.Web.Features.Models.Blogs; @@ -40,7 +41,7 @@ public class ContentPreviewTests private Mock _contextAccessorMock; private Customer _customer; private Mock _mediatorMock; - private Mock _permissionServiceMock; + private Mock _permissionServiceMock; [TestInitialize] public void Init() @@ -62,7 +63,7 @@ public void Init() _aclServiceMock.Setup(x => x.Authorize(It.IsAny(), It.IsAny())).Returns(true); _aclServiceMock.Setup(x => x.Authorize(It.IsAny(), It.IsAny())).Returns(true); - _permissionServiceMock = new Mock(); + _permissionServiceMock = new Mock(); _mediatorMock = new Mock(); _mediatorMock.Setup(x => x.Send(It.IsAny(), It.IsAny())) .ReturnsAsync(new NewsItemModel()); diff --git a/src/Tests/Grand.Web.Tests/Validators/ShoppingCart/UpdateQuantityValidatorTests.cs b/src/Tests/Grand.Web.Tests/Validators/ShoppingCart/UpdateQuantityValidatorTests.cs index 488c2a4b82..6d8380a810 100644 --- a/src/Tests/Grand.Web.Tests/Validators/ShoppingCart/UpdateQuantityValidatorTests.cs +++ b/src/Tests/Grand.Web.Tests/Validators/ShoppingCart/UpdateQuantityValidatorTests.cs @@ -1,10 +1,10 @@ using Grand.Business.Core.Interfaces.Checkout.Orders; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Customers; using Grand.Domain.Orders; using Grand.Domain.Permissions; using Grand.Infrastructure; using Grand.Infrastructure.Validators; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Models.ShoppingCart; using Grand.Web.Validators.ShoppingCart; using Microsoft.VisualStudio.TestTools.UnitTesting; @@ -17,7 +17,7 @@ public class UpdateQuantityValidatorTests { private static UpdateQuantityValidator Validator(ShoppingCartItem item, bool cartEnabled, bool wishlistEnabled) { - var permissionService = new Mock(); + var permissionService = new Mock(); permissionService.Setup(p => p.Authorize(It.Is(x => x.SystemName == StandardPermission.EnableShoppingCart.SystemName))) .ReturnsAsync(cartEnabled); diff --git a/src/Web/Grand.SharedUIResources/Views/Shared/EditorTemplates/Editor.cshtml b/src/Web/Grand.SharedUIResources/Views/Shared/EditorTemplates/Editor.cshtml index 3a55416c77..b786f4dc7b 100644 --- a/src/Web/Grand.SharedUIResources/Views/Shared/EditorTemplates/Editor.cshtml +++ b/src/Web/Grand.SharedUIResources/Views/Shared/EditorTemplates/Editor.cshtml @@ -1,9 +1,9 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @using Grand.SharedKernel.Extensions @model string -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @inject Microsoft.AspNetCore.Antiforgery.IAntiforgery antiforgery @{ var allowFileman = await permissionService.Authorize(StandardPermission.HtmlEditorManagePictures); diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Customer/Partials/CreateOrUpdate.TabActivityLog.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Customer/Partials/CreateOrUpdate.TabActivityLog.cshtml index e0a63fef7b..69dc189e7d 100644 --- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Customer/Partials/CreateOrUpdate.TabActivityLog.cshtml +++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Customer/Partials/CreateOrUpdate.TabActivityLog.cshtml @@ -1,8 +1,8 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @model CustomerModel @inject AdminAreaSettings adminAreaSettings -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ var defaultGridPageSize = adminAreaSettings.DefaultGridPageSize; var gridPageSizes = adminAreaSettings.GridPageSizes; diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerGroup/Partials/CreateOrUpdate.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerGroup/Partials/CreateOrUpdate.cshtml index 43996bdf2c..b0c0424a3f 100644 --- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerGroup/Partials/CreateOrUpdate.cshtml +++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/CustomerGroup/Partials/CreateOrUpdate.cshtml @@ -1,7 +1,7 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @model CustomerGroupModel -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ var access = await permissionService.Authorize(StandardPermission.ManageAcl); } diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Home/Index.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Home/Index.cshtml index fbf61636b9..a96db95118 100644 --- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Home/Index.cshtml +++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Home/Index.cshtml @@ -1,12 +1,12 @@ @using Grand.Business.Core.Interfaces.Catalog.Prices @using Grand.Business.Core.Interfaces.Common.Directory -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Business.Core.Interfaces.Customers @using Grand.Business.Core.Interfaces.System.Reports @using Grand.Domain.Permissions @using Grand.Domain.Customers @inject CustomerSettings customerSettings -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @inject ICustomerService customerService @inject IOrderReportService orderReportService @inject IPriceFormatter priceFormatter diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Home/Statistics.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Home/Statistics.cshtml index a540a8c86e..4f38ae961a 100644 --- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Home/Statistics.cshtml +++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Home/Statistics.cshtml @@ -1,6 +1,6 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ //page title diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Partials/Menu.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Partials/Menu.cshtml index df44e3cdbd..083de652d6 100644 --- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Partials/Menu.cshtml +++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/Partials/Menu.cshtml @@ -1,9 +1,9 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Business.Core.Interfaces.System.Admin @using Grand.Domain.Permissions @using Grand.Web.Common.Menu @using Constants = Grand.SharedUIResources.Constants -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @inject IAdminSiteMapService adminSiteMapService @inject IEnumerable _adminMenuProviders @{ diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml index f3ff07b76f..78ddcf1d89 100644 --- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml +++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Shared/_AdminLayout.cshtml @@ -1,11 +1,11 @@ @using System.Text.Encodings.Web @using Grand.Business.Core.Interfaces.Common.Directory -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @using Grand.Domain.Customers @using Grand.Domain.Localization @inject IContextAccessor contextAccessor -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @inject CustomerSettings customerSettings @inject LanguageSettings languageSettings @inject IGroupService groupService diff --git a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Vendor/Partials/CreateOrUpdate.cshtml b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Vendor/Partials/CreateOrUpdate.cshtml index cd26b2e204..deedc27eee 100644 --- a/src/Web/Grand.Web.Admin/Areas/Admin/Views/Vendor/Partials/CreateOrUpdate.cshtml +++ b/src/Web/Grand.Web.Admin/Areas/Admin/Views/Vendor/Partials/CreateOrUpdate.cshtml @@ -1,7 +1,7 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @model VendorModel -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ //has "Manage Documents" permission? var canManageDocuments = await permissionService.Authorize(StandardPermission.ManageDocuments); diff --git a/src/Web/Grand.Web.Admin/Components/AdminPage.cs b/src/Web/Grand.Web.Admin/Components/AdminPage.cs index 22c21c493f..2437be02f4 100644 --- a/src/Web/Grand.Web.Admin/Components/AdminPage.cs +++ b/src/Web/Grand.Web.Admin/Components/AdminPage.cs @@ -1,11 +1,11 @@ using Grand.Business.Core.Extensions; using Grand.Business.Core.Interfaces.Cms; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Infrastructure; using Grand.Infrastructure.Security; using Grand.Web.Admin.Models.Cms; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; @@ -18,14 +18,14 @@ namespace Grand.Web.Admin.Components; public class AdminPageViewComponent : BaseAdminViewComponent { private readonly IPageService _pageService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IHtmlSanitizationService _htmlSanitizationService; private readonly IContextAccessor _contextAccessor; private readonly ILogger _logger; public AdminPageViewComponent( IPageService pageService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IHtmlSanitizationService htmlSanitizationService, IContextAccessor contextAccessor, ILogger logger) diff --git a/src/Web/Grand.Web.Admin/Components/BestsellersBriefReportByAmount.cs b/src/Web/Grand.Web.Admin/Components/BestsellersBriefReportByAmount.cs index f6659d3d7c..cd4e7f7aa6 100644 --- a/src/Web/Grand.Web.Admin/Components/BestsellersBriefReportByAmount.cs +++ b/src/Web/Grand.Web.Admin/Components/BestsellersBriefReportByAmount.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; public class BestsellersBriefReportByAmountViewComponent : BaseAdminViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public BestsellersBriefReportByAmountViewComponent(IPermissionService permissionService) + public BestsellersBriefReportByAmountViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Admin/Components/BestsellersBriefReportByQuantity.cs b/src/Web/Grand.Web.Admin/Components/BestsellersBriefReportByQuantity.cs index d611fab3c1..fc09ae4215 100644 --- a/src/Web/Grand.Web.Admin/Components/BestsellersBriefReportByQuantity.cs +++ b/src/Web/Grand.Web.Admin/Components/BestsellersBriefReportByQuantity.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; public class BestsellersBriefReportByQuantityViewComponent : BaseAdminViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public BestsellersBriefReportByQuantityViewComponent(IPermissionService permissionService) + public BestsellersBriefReportByQuantityViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Admin/Components/CustomerReportRegistered.cs b/src/Web/Grand.Web.Admin/Components/CustomerReportRegistered.cs index 3326333b7a..ac25344286 100644 --- a/src/Web/Grand.Web.Admin/Components/CustomerReportRegistered.cs +++ b/src/Web/Grand.Web.Admin/Components/CustomerReportRegistered.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; public class CustomerReportRegisteredViewComponent : BaseAdminViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public CustomerReportRegisteredViewComponent(IPermissionService permissionService) + public CustomerReportRegisteredViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Admin/Components/CustomerReportTimeChart.cs b/src/Web/Grand.Web.Admin/Components/CustomerReportTimeChart.cs index 19fabfaeeb..ac0dab9bdd 100644 --- a/src/Web/Grand.Web.Admin/Components/CustomerReportTimeChart.cs +++ b/src/Web/Grand.Web.Admin/Components/CustomerReportTimeChart.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; public class CustomerReportTimeChartViewComponent : BaseAdminViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public CustomerReportTimeChartViewComponent(IPermissionService permissionService) + public CustomerReportTimeChartViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Admin/Components/LatestOrder.cs b/src/Web/Grand.Web.Admin/Components/LatestOrder.cs index 71137ef319..f0f427734c 100644 --- a/src/Web/Grand.Web.Admin/Components/LatestOrder.cs +++ b/src/Web/Grand.Web.Admin/Components/LatestOrder.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; public class LatestOrderViewComponent : BaseAdminViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public LatestOrderViewComponent(IPermissionService permissionService) + public LatestOrderViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Admin/Components/OrderAverageReport.cs b/src/Web/Grand.Web.Admin/Components/OrderAverageReport.cs index a55d7739b3..ef021f70c5 100644 --- a/src/Web/Grand.Web.Admin/Components/OrderAverageReport.cs +++ b/src/Web/Grand.Web.Admin/Components/OrderAverageReport.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; public class OrderAverageReportViewComponent : BaseAdminViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public OrderAverageReportViewComponent(IPermissionService permissionService) + public OrderAverageReportViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Admin/Components/OrderIncompleteReport.cs b/src/Web/Grand.Web.Admin/Components/OrderIncompleteReport.cs index 6ec0586181..c533ee7564 100644 --- a/src/Web/Grand.Web.Admin/Components/OrderIncompleteReport.cs +++ b/src/Web/Grand.Web.Admin/Components/OrderIncompleteReport.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; public class OrderIncompleteReportViewComponent : BaseAdminViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public OrderIncompleteReportViewComponent(IPermissionService permissionService) + public OrderIncompleteReportViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Admin/Components/OrderPeriodReport.cs b/src/Web/Grand.Web.Admin/Components/OrderPeriodReport.cs index db2ee896a8..dbb22afe79 100644 --- a/src/Web/Grand.Web.Admin/Components/OrderPeriodReport.cs +++ b/src/Web/Grand.Web.Admin/Components/OrderPeriodReport.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; public class OrderPeriodReportViewComponent : BaseAdminViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public OrderPeriodReportViewComponent(IPermissionService permissionService) + public OrderPeriodReportViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Admin/Components/OrderTimeChart.cs b/src/Web/Grand.Web.Admin/Components/OrderTimeChart.cs index 27b90bcf6c..d2b2e1e930 100644 --- a/src/Web/Grand.Web.Admin/Components/OrderTimeChart.cs +++ b/src/Web/Grand.Web.Admin/Components/OrderTimeChart.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; public class OrderTimeChartViewComponent : BaseAdminViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public OrderTimeChartViewComponent(IPermissionService permissionService) + public OrderTimeChartViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Admin/Components/PopularSearchTermsReport.cs b/src/Web/Grand.Web.Admin/Components/PopularSearchTermsReport.cs index 004e611122..1df43bc2fd 100644 --- a/src/Web/Grand.Web.Admin/Components/PopularSearchTermsReport.cs +++ b/src/Web/Grand.Web.Admin/Components/PopularSearchTermsReport.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Components; public class PopularSearchTermsReportViewComponent : BaseAdminViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public PopularSearchTermsReportViewComponent(IPermissionService permissionService) + public PopularSearchTermsReportViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Admin/Controllers/AffiliateController.cs b/src/Web/Grand.Web.Admin/Controllers/AffiliateController.cs index ff4d6b13e4..882c0ade5b 100644 --- a/src/Web/Grand.Web.Admin/Controllers/AffiliateController.cs +++ b/src/Web/Grand.Web.Admin/Controllers/AffiliateController.cs @@ -1,5 +1,4 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Business.Core.Interfaces.Customers; +using Grand.Business.Core.Interfaces.Customers; using Grand.Domain.Permissions; using Grand.Web.AdminShared.Interfaces; using Grand.Web.AdminShared.Models.Affiliates; @@ -18,7 +17,7 @@ public class AffiliateController : BaseAdminController public AffiliateController(IRequestTranslationService translationService, IAffiliateService affiliateService, IAffiliateViewModelService affiliateViewModelService, - IPermissionService permissionService) + IRequestPermissionService permissionService) { _translationService = translationService; _affiliateService = affiliateService; @@ -33,7 +32,7 @@ public AffiliateController(IRequestTranslationService translationService, private readonly IRequestTranslationService _translationService; private readonly IAffiliateService _affiliateService; private readonly IAffiliateViewModelService _affiliateViewModelService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; #endregion diff --git a/src/Web/Grand.Web.Admin/Controllers/CustomerController.cs b/src/Web/Grand.Web.Admin/Controllers/CustomerController.cs index 83ddf8dbc3..3a72c24f40 100644 --- a/src/Web/Grand.Web.Admin/Controllers/CustomerController.cs +++ b/src/Web/Grand.Web.Admin/Controllers/CustomerController.cs @@ -3,6 +3,7 @@ using Grand.Web.Common.Filters; using Microsoft.AspNetCore.Mvc; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; namespace Grand.Web.Admin.Controllers; @@ -28,7 +29,7 @@ public class CustomerController( Grand.Infrastructure.IContextAccessor contextAccessor, Grand.Domain.Customers.CustomerSettings customerSettings, Grand.Web.AdminShared.Interfaces.IAdminDataScope scope, - Grand.Business.Core.Interfaces.Common.Security.IPermissionService permissionService, + IRequestPermissionService permissionService, Grand.Business.Core.Interfaces.ExportImport.IExportManager exportManager) : BaseCustomerManagementController(customerService, customerViewModelService, customerManagerService, customerProductService, productReviewService, productReviewViewModelService, productViewModelService, diff --git a/src/Web/Grand.Web.Admin/Controllers/ElFinderController.cs b/src/Web/Grand.Web.Admin/Controllers/ElFinderController.cs index 9c68586233..ad37af58d1 100644 --- a/src/Web/Grand.Web.Admin/Controllers/ElFinderController.cs +++ b/src/Web/Grand.Web.Admin/Controllers/ElFinderController.cs @@ -1,5 +1,4 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.AdminShared.Interfaces; using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; @@ -12,7 +11,7 @@ public class ElFinderController : BaseAdminController #region Ctor public ElFinderController( - IPermissionService permissionService, + IRequestPermissionService permissionService, IElFinderViewModelService elFinderViewModelService ) { @@ -24,7 +23,7 @@ IElFinderViewModelService elFinderViewModelService #region Fields - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IElFinderViewModelService _elFinderViewModelService; #endregion diff --git a/src/Web/Grand.Web.Admin/Controllers/OrderTagsController.cs b/src/Web/Grand.Web.Admin/Controllers/OrderTagsController.cs index 99983b1c45..d996a5ac9a 100644 --- a/src/Web/Grand.Web.Admin/Controllers/OrderTagsController.cs +++ b/src/Web/Grand.Web.Admin/Controllers/OrderTagsController.cs @@ -1,5 +1,4 @@ using Grand.Business.Core.Interfaces.Checkout.Orders; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Web.AdminShared.Models.Orders; using Grand.Web.Common.DataSource; @@ -14,10 +13,10 @@ public class OrderTagsController : BaseAdminController { private readonly IOrderService _orderService; private readonly IOrderTagService _orderTagService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; public OrderTagsController(IOrderTagService orderTagService, IOrderService orderService, - IPermissionService permissionService) + IRequestPermissionService permissionService) { _orderTagService = orderTagService; _orderService = orderService; diff --git a/src/Web/Grand.Web.Admin/Controllers/PictureController.cs b/src/Web/Grand.Web.Admin/Controllers/PictureController.cs index 7f9e5be1ec..ae949d9356 100644 --- a/src/Web/Grand.Web.Admin/Controllers/PictureController.cs +++ b/src/Web/Grand.Web.Admin/Controllers/PictureController.cs @@ -1,4 +1,3 @@ -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Storage; using Grand.Domain.Media; using Grand.Web.Admin.Extensions; @@ -15,7 +14,7 @@ namespace Grand.Web.Admin.Controllers; [AuthorizeMenu] public class PictureController( IPictureService pictureService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IMediaFileStore mediaFileStore, MediaSettings mediaSettings) : BasePictureController(pictureService, permissionService, mediaFileStore, mediaSettings) diff --git a/src/Web/Grand.Web.Admin/Controllers/ProductController.cs b/src/Web/Grand.Web.Admin/Controllers/ProductController.cs index c55a0b4bfb..44c0b30138 100644 --- a/src/Web/Grand.Web.Admin/Controllers/ProductController.cs +++ b/src/Web/Grand.Web.Admin/Controllers/ProductController.cs @@ -1,13 +1,13 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Common.Directory; using Grand.Business.Core.Interfaces.Common.Localization; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Catalog; using Grand.Web.Admin.Extensions; using Grand.Web.AdminShared.Controllers; using Grand.Web.AdminShared.Interfaces; using Grand.Web.Common.Filters; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Admin.Controllers; @@ -25,7 +25,7 @@ public class ProductController( IProductReservationService productReservationService, IAuctionService auctionService, IDateTimeService dateTimeService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IEnumTranslationService enumTranslationService, IAdminDataScope scope) : BaseProductController(productViewModelService, productService, inventoryManageService, languageService, diff --git a/src/Web/Grand.Web.Admin/Controllers/ReportsController.cs b/src/Web/Grand.Web.Admin/Controllers/ReportsController.cs index c6dd9214bd..682ff7effb 100644 --- a/src/Web/Grand.Web.Admin/Controllers/ReportsController.cs +++ b/src/Web/Grand.Web.Admin/Controllers/ReportsController.cs @@ -3,7 +3,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Checkout.Orders; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Common.Stores; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Interfaces.System.Reports; @@ -46,7 +45,7 @@ public class ReportsController( IReportDataScope scope, IOrderService orderService, ICustomerReportService customerReportService, - IPermissionService permissionService, + IRequestPermissionService permissionService, ISearchTermService searchTermService) : BaseFullReportsController(orderReportService, productsReportService, customerReportViewModelService, priceFormatter, currencyService, productService, productAttributeFormatter, stockQuantityService, diff --git a/src/Web/Grand.Web.AdminShared/Controllers/BaseCustomerController.cs b/src/Web/Grand.Web.AdminShared/Controllers/BaseCustomerController.cs index edfb9063fe..e805f309ef 100644 --- a/src/Web/Grand.Web.AdminShared/Controllers/BaseCustomerController.cs +++ b/src/Web/Grand.Web.AdminShared/Controllers/BaseCustomerController.cs @@ -4,7 +4,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Common.Addresses; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Interfaces.Marketing.Customers; using Grand.Business.Core.Interfaces.Messages; @@ -578,7 +577,7 @@ public async Task AddressEdit(CustomerAddressModel model) public async Task OrderList(string customerId, DataSourceRequest command, [FromServices] Grand.Business.Core.Interfaces.Checkout.Orders.IOrderService orderService, [FromServices] Grand.Web.AdminShared.Interfaces.IOrderViewModelService orderViewModelService, - [FromServices] IPermissionService permissionService) + [FromServices] IRequestPermissionService permissionService) { if (scope.DefaultStoreId is not null) { @@ -603,7 +602,7 @@ public async Task OrderList(string customerId, DataSourceRequest public async Task OrderDetails(string orderId, [FromServices] Grand.Business.Core.Interfaces.Checkout.Orders.IOrderService orderService, [FromServices] Grand.Web.AdminShared.Interfaces.IOrderViewModelService orderViewModelService, - [FromServices] IPermissionService permissionService) + [FromServices] IRequestPermissionService permissionService) { Grand.Domain.Orders.Order order; if (scope.DefaultStoreId is null) diff --git a/src/Web/Grand.Web.AdminShared/Controllers/BaseCustomerManagementController.cs b/src/Web/Grand.Web.AdminShared/Controllers/BaseCustomerManagementController.cs index d27404cd47..0a923e3a8b 100644 --- a/src/Web/Grand.Web.AdminShared/Controllers/BaseCustomerManagementController.cs +++ b/src/Web/Grand.Web.AdminShared/Controllers/BaseCustomerManagementController.cs @@ -3,7 +3,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Common.Addresses; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Interfaces.ExportImport; using Grand.Business.Core.Interfaces.Marketing.Customers; @@ -39,7 +38,7 @@ public abstract class BaseCustomerManagementController( IContextAccessor contextAccessor, CustomerSettings customerSettings, IAdminDataScope scope, - IPermissionService permissionService, + IRequestPermissionService permissionService, IExportManager exportManager) : BaseCustomerController(customerService, customerViewModelService, customerManagerService, customerProductService, productReviewService, productReviewViewModelService, productViewModelService, diff --git a/src/Web/Grand.Web.AdminShared/Controllers/BaseFullReportsController.cs b/src/Web/Grand.Web.AdminShared/Controllers/BaseFullReportsController.cs index c97e670b5e..3f293d3ceb 100644 --- a/src/Web/Grand.Web.AdminShared/Controllers/BaseFullReportsController.cs +++ b/src/Web/Grand.Web.AdminShared/Controllers/BaseFullReportsController.cs @@ -5,7 +5,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Checkout.Orders; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Common.Stores; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Interfaces.System.Reports; @@ -20,6 +19,7 @@ using Grand.Web.AdminShared.Models.Orders; using Grand.Web.Common.DataSource; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.AdminShared.Controllers; @@ -45,7 +45,7 @@ public abstract class BaseFullReportsController( IReportDataScope scope, IOrderService orderService, ICustomerReportService customerReportService, - IPermissionService permissionService) + IRequestPermissionService permissionService) : BaseReportsController(orderReportService, productsReportService, customerReportViewModelService, priceFormatter, currencyService, productService, productAttributeFormatter, stockQuantityService, translationService, storeService, countryService, vendorService, dateTimeService, orderStatusService, @@ -53,7 +53,7 @@ public abstract class BaseFullReportsController( { protected IOrderService OrderService => orderService; protected ICustomerReportService CustomerReportService => customerReportService; - protected IPermissionService PermissionService => permissionService; + protected IRequestPermissionService PermissionService => permissionService; #region Bestsellers-brief ManageOrders overrides diff --git a/src/Web/Grand.Web.AdminShared/Controllers/BasePictureController.cs b/src/Web/Grand.Web.AdminShared/Controllers/BasePictureController.cs index 562645057e..543d68df45 100644 --- a/src/Web/Grand.Web.AdminShared/Controllers/BasePictureController.cs +++ b/src/Web/Grand.Web.AdminShared/Controllers/BasePictureController.cs @@ -1,4 +1,3 @@ -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Storage; using Grand.Domain.Common; using Grand.Domain.Media; @@ -17,7 +16,7 @@ namespace Grand.Web.AdminShared.Controllers; [AutoValidateAntiforgeryToken] public abstract class BasePictureController( IPictureService pictureService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IMediaFileStore mediaFileStore, MediaSettings mediaSettings) : BaseController diff --git a/src/Web/Grand.Web.AdminShared/Controllers/BaseProductController.cs b/src/Web/Grand.Web.AdminShared/Controllers/BaseProductController.cs index c3933e236e..15eb5161cf 100644 --- a/src/Web/Grand.Web.AdminShared/Controllers/BaseProductController.cs +++ b/src/Web/Grand.Web.AdminShared/Controllers/BaseProductController.cs @@ -3,7 +3,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Common.Directory; using Grand.Business.Core.Interfaces.Common.Localization; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.ExportImport; using Grand.Business.Core.Interfaces.Storage; using Grand.Business.Core.Utilities.Catalog; @@ -41,7 +40,7 @@ public abstract class BaseProductController( IProductReservationService productReservationService, IAuctionService auctionService, IDateTimeService dateTimeService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IEnumTranslationService enumTranslationService, IAdminDataScope scope) : BaseController diff --git a/src/Web/Grand.Web.AdminShared/Validators/Customers/CustomerGroupAclUpdateValidator.cs b/src/Web/Grand.Web.AdminShared/Validators/Customers/CustomerGroupAclUpdateValidator.cs index ad20304348..106b41dd1c 100644 --- a/src/Web/Grand.Web.AdminShared/Validators/Customers/CustomerGroupAclUpdateValidator.cs +++ b/src/Web/Grand.Web.AdminShared/Validators/Customers/CustomerGroupAclUpdateValidator.cs @@ -1,16 +1,16 @@ using FluentValidation; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Infrastructure.Validators; using Grand.Web.AdminShared.Models.Customers; +using Grand.Web.Common.Security.Authorization; namespace Grand.Web.AdminShared.Validators.Customers; public class CustomerGroupAclUpdateValidator : BaseGrandValidator { public CustomerGroupAclUpdateValidator(IEnumerable> validators, - IGroupService groupService, IPermissionService permissionService) + IGroupService groupService, IRequestPermissionService permissionService) : base(validators) { RuleFor(x => x).CustomAsync(async (x, context, _) => diff --git a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Brand/Partials/CreateOrUpdate.cshtml b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Brand/Partials/CreateOrUpdate.cshtml index c1727e9392..53f46b0975 100644 --- a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Brand/Partials/CreateOrUpdate.cshtml +++ b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Brand/Partials/CreateOrUpdate.cshtml @@ -1,7 +1,7 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @model BrandModel -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ //has "Manage Documents" permission? var canManageDocuments = await permissionService.Authorize(StandardPermission.ManageDocuments); diff --git a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Category/Partials/CreateOrUpdate.cshtml b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Category/Partials/CreateOrUpdate.cshtml index cccce9c257..9fbdb73d19 100644 --- a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Category/Partials/CreateOrUpdate.cshtml +++ b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Category/Partials/CreateOrUpdate.cshtml @@ -1,7 +1,7 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @model CategoryModel -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ //has "Manage Documents" permission? var canManageDocuments = await permissionService.Authorize(StandardPermission.ManageDocuments); diff --git a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Collection/Partials/CreateOrUpdate.cshtml b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Collection/Partials/CreateOrUpdate.cshtml index 060ded567e..28f686ae9b 100644 --- a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Collection/Partials/CreateOrUpdate.cshtml +++ b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Collection/Partials/CreateOrUpdate.cshtml @@ -1,7 +1,7 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @model CollectionModel -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ //has "Manage Documents" permission? var canManageDocuments = await permissionService.Authorize(StandardPermission.ManageDocuments); diff --git a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Customer/Partials/CreateOrUpdate.cshtml b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Customer/Partials/CreateOrUpdate.cshtml index af0df12ea3..9bcbf1f401 100644 --- a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Customer/Partials/CreateOrUpdate.cshtml +++ b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Customer/Partials/CreateOrUpdate.cshtml @@ -1,8 +1,8 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Customers @using Grand.Domain.Permissions @model CustomerModel -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @inject IAdminDataScope Scope @{ var area = ViewContext.RouteData.Values["area"]?.ToString(); diff --git a/src/Web/Grand.Web.AdminShared/Views/AdminShared/MerchandiseReturn/Partials/CreateOrUpdate.cshtml b/src/Web/Grand.Web.AdminShared/Views/AdminShared/MerchandiseReturn/Partials/CreateOrUpdate.cshtml index d33cecee96..3de3efa4e6 100644 --- a/src/Web/Grand.Web.AdminShared/Views/AdminShared/MerchandiseReturn/Partials/CreateOrUpdate.cshtml +++ b/src/Web/Grand.Web.AdminShared/Views/AdminShared/MerchandiseReturn/Partials/CreateOrUpdate.cshtml @@ -1,9 +1,9 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Orders @using Grand.Domain.Permissions @model MerchandiseReturnModel @inject OrderSettings orderSettings -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ //has "Manage Documents" permission? var canManageDocuments = await permissionService.Authorize(StandardPermission.ManageDocuments); diff --git a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Order/Edit.cshtml b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Order/Edit.cshtml index 919688dde1..524e1de4bb 100644 --- a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Order/Edit.cshtml +++ b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Order/Edit.cshtml @@ -1,7 +1,7 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @model OrderModel -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ //page title ViewBag.Title = Loc["Admin.Orders.EditOrderDetails"]; diff --git a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Order/Partials/OrderDetails.Shipment.cshtml b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Order/Partials/OrderDetails.Shipment.cshtml index 2e9b12541a..b122f9fe30 100644 --- a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Order/Partials/OrderDetails.Shipment.cshtml +++ b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Order/Partials/OrderDetails.Shipment.cshtml @@ -1,8 +1,8 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @using Grand.Domain.Orders @model OrderModel -@inject IPermissionService permissionService; +@inject IRequestPermissionService permissionService; @inject IAdminDataScope Scope @{ var area = ViewContext.RouteData.Values["area"]?.ToString(); diff --git a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Product/Partials/Tab.Documents.cshtml b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Product/Partials/Tab.Documents.cshtml index f41e89669d..da1cb5bdb4 100644 --- a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Product/Partials/Tab.Documents.cshtml +++ b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Product/Partials/Tab.Documents.cshtml @@ -1,7 +1,7 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @model ProductModel -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ var canManageDocuments = await permissionService.Authorize(StandardPermission.ManageDocuments); } diff --git a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Shipment/ShipmentDetails.cshtml b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Shipment/ShipmentDetails.cshtml index 1616906fec..09b5ba7f93 100644 --- a/src/Web/Grand.Web.AdminShared/Views/AdminShared/Shipment/ShipmentDetails.cshtml +++ b/src/Web/Grand.Web.AdminShared/Views/AdminShared/Shipment/ShipmentDetails.cshtml @@ -1,7 +1,7 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @model ShipmentModel -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ //page title ViewBag.Title = Loc["Admin.Orders.Shipments.ViewDetails"]; diff --git a/src/Web/Grand.Web.Common/Filters/AuthorizeAdminAttribute.cs b/src/Web/Grand.Web.Common/Filters/AuthorizeAdminAttribute.cs index 32e930b7b7..3d43a0c755 100644 --- a/src/Web/Grand.Web.Common/Filters/AuthorizeAdminAttribute.cs +++ b/src/Web/Grand.Web.Common/Filters/AuthorizeAdminAttribute.cs @@ -1,9 +1,9 @@ using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Data; using Grand.Domain.Security; using Grand.Infrastructure; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Filters; using Microsoft.AspNetCore.Routing; @@ -32,7 +32,7 @@ public AuthorizeAdminAttribute(bool ignore = false) : base(typeof(AuthorizeAdmin /// /// Represents a filter that confirms access to the admin panel /// - private class AuthorizeAdminFilter(bool ignoreFilter, IPermissionService permissionService, + private class AuthorizeAdminFilter(bool ignoreFilter, IRequestPermissionService permissionService, SecuritySettings securitySettings, IContextAccessor contextAccessor, IGroupService groupService) : IAsyncAuthorizationFilter { const string routeName = "AdminLogin"; diff --git a/src/Web/Grand.Web.Common/Filters/AuthorizeAdminOrStoreAttribute.cs b/src/Web/Grand.Web.Common/Filters/AuthorizeAdminOrStoreAttribute.cs index 0d95cb2343..81a73ca749 100644 --- a/src/Web/Grand.Web.Common/Filters/AuthorizeAdminOrStoreAttribute.cs +++ b/src/Web/Grand.Web.Common/Filters/AuthorizeAdminOrStoreAttribute.cs @@ -1,9 +1,9 @@ using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Data; using Grand.Domain.Security; using Grand.Infrastructure; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Filters; using Microsoft.AspNetCore.Routing; @@ -32,7 +32,7 @@ public AuthorizeAdminOrStoreAttribute(bool ignore = false) : base(typeof(Authori private class AuthorizeAdminOrStoreFilter( bool ignoreFilter, - IPermissionService permissionService, + IRequestPermissionService permissionService, SecuritySettings securitySettings, IContextAccessor contextAccessor, IGroupService groupService) : IAsyncAuthorizationFilter diff --git a/src/Web/Grand.Web.Common/Filters/AuthorizeStoreAttribute.cs b/src/Web/Grand.Web.Common/Filters/AuthorizeStoreAttribute.cs index f6d0effab2..2b68856463 100644 --- a/src/Web/Grand.Web.Common/Filters/AuthorizeStoreAttribute.cs +++ b/src/Web/Grand.Web.Common/Filters/AuthorizeStoreAttribute.cs @@ -1,8 +1,8 @@ using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Data; using Grand.Infrastructure; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Filters; using Microsoft.AspNetCore.Routing; @@ -34,7 +34,7 @@ public AuthorizeStoreAttribute(bool ignore = false) : base(typeof(AuthorizeStore /// (and active) /// private class AuthorizeStoreFilter(bool ignoreFilter, IContextAccessor contextAccessor, IGroupService groupService, - IPermissionService permissionService) : IAsyncAuthorizationFilter + IRequestPermissionService permissionService) : IAsyncAuthorizationFilter { #region Methods diff --git a/src/Web/Grand.Web.Common/Filters/AuthorizeVendorAttribute.cs b/src/Web/Grand.Web.Common/Filters/AuthorizeVendorAttribute.cs index 65f87947cb..f2a75183d7 100644 --- a/src/Web/Grand.Web.Common/Filters/AuthorizeVendorAttribute.cs +++ b/src/Web/Grand.Web.Common/Filters/AuthorizeVendorAttribute.cs @@ -1,8 +1,8 @@ using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Data; using Grand.Infrastructure; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Filters; using Microsoft.AspNetCore.Routing; @@ -34,7 +34,7 @@ public AuthorizeVendorAttribute(bool ignore = false) : base(typeof(AuthorizeVend /// (and active) /// private class AuthorizeVendorFilter(bool ignoreFilter, IContextAccessor contextAccessor, IGroupService groupService, - IPermissionService permissionService) : IAsyncAuthorizationFilter + IRequestPermissionService permissionService) : IAsyncAuthorizationFilter { #region Methods diff --git a/src/Web/Grand.Web.Common/Filters/ClosedStoreAttribute.cs b/src/Web/Grand.Web.Common/Filters/ClosedStoreAttribute.cs index 7782b96838..4266592297 100644 --- a/src/Web/Grand.Web.Common/Filters/ClosedStoreAttribute.cs +++ b/src/Web/Grand.Web.Common/Filters/ClosedStoreAttribute.cs @@ -1,10 +1,10 @@ using Grand.Business.Core.Interfaces.Cms; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Data; using Grand.Domain.Stores; using Grand.Infrastructure; using Grand.Web.Common.Extensions; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Controllers; using Microsoft.AspNetCore.Mvc.Filters; @@ -35,7 +35,7 @@ public ClosedStoreAttribute(bool ignore = false) : base(typeof(CheckAccessClosed /// Represents a filter that confirms access to closed store /// private class CheckAccessClosedStoreFilter(bool ignoreFilter, - IPermissionService permissionService, + IRequestPermissionService permissionService, IContextAccessor contextAccessor, IPageService pageService, StoreInformationSettings storeInformationSettings) : IAsyncActionFilter diff --git a/src/Web/Grand.Web.Common/Filters/PublicStoreAttribute.cs b/src/Web/Grand.Web.Common/Filters/PublicStoreAttribute.cs index 503c9986be..9eaaefa842 100644 --- a/src/Web/Grand.Web.Common/Filters/PublicStoreAttribute.cs +++ b/src/Web/Grand.Web.Common/Filters/PublicStoreAttribute.cs @@ -1,7 +1,7 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Data; using Grand.Domain.Stores; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Filters; using Microsoft.AspNetCore.Routing; @@ -30,7 +30,7 @@ public PublicStoreAttribute(bool ignore = false) : base(typeof(AccessPublicStore /// /// Represents a filter that confirms access to public store /// - private class AccessPublicStoreFilter(bool ignoreFilter, IPermissionService permissionService, + private class AccessPublicStoreFilter(bool ignoreFilter, IRequestPermissionService permissionService, StoreInformationSettings storeInformationSettings) : IAsyncAuthorizationFilter { diff --git a/src/Web/Grand.Web.Common/Menu/SiteMap.cs b/src/Web/Grand.Web.Common/Menu/SiteMap.cs index 496ca7cb1e..dcbe9e45e2 100644 --- a/src/Web/Grand.Web.Common/Menu/SiteMap.cs +++ b/src/Web/Grand.Web.Common/Menu/SiteMap.cs @@ -1,17 +1,17 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Business.Core.Interfaces.System.Admin; +using Grand.Business.Core.Interfaces.System.Admin; using Grand.Domain.Admin; +using Grand.Web.Common.Security.Authorization; namespace Grand.Web.Common.Menu; public class SiteMap { private readonly IAdminSiteMapService _adminSiteMapService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; public SiteMap( IAdminSiteMapService adminSiteMapService, - IPermissionService permissionService) + IRequestPermissionService permissionService) { _adminSiteMapService = adminSiteMapService; _permissionService = permissionService; diff --git a/src/Web/Grand.Web.Common/Security/Authorization/IRequestPermissionService.cs b/src/Web/Grand.Web.Common/Security/Authorization/IRequestPermissionService.cs new file mode 100644 index 0000000000..f91323c95e --- /dev/null +++ b/src/Web/Grand.Web.Common/Security/Authorization/IRequestPermissionService.cs @@ -0,0 +1,24 @@ +using Grand.Business.Core.Interfaces.Common.Security; +using Grand.Domain.Permissions; + +namespace Grand.Web.Common.Security.Authorization; + +/// +/// Permission service for code that runs inside a request +/// +public interface IRequestPermissionService : IPermissionService +{ + /// + /// Authorizes the customer of the current request. + /// + /// Permission + /// true - authorized; otherwise, false + Task Authorize(Permission permission); + + /// + /// Authorizes the customer of the current request. + /// + /// Permission system name + /// true - authorized; otherwise, false + Task Authorize(string permissionSystemName); +} diff --git a/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs b/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs index a62d3707bf..c4b7559848 100644 --- a/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs +++ b/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs @@ -1,5 +1,4 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Infrastructure; using Grand.Web.Common.DataSource; using Microsoft.AspNetCore.Mvc; @@ -35,7 +34,7 @@ public async Task OnAuthorizationAsync(AuthorizationFilterContext context) if (permissionAuthorize == null || string.IsNullOrEmpty(permissionAuthorize.Permission)) return; - var permissionService = context.HttpContext.RequestServices.GetRequiredService(); + var permissionService = context.HttpContext.RequestServices.GetRequiredService(); var contextAccessor = context.HttpContext.RequestServices.GetRequiredService(); //check whether current customer has access to a public store diff --git a/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeAttribute.cs b/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeAttribute.cs index 52db8c2bf8..9e39334865 100644 --- a/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeAttribute.cs +++ b/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeAttribute.cs @@ -1,5 +1,4 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Filters; using Microsoft.AspNetCore.Routing; @@ -26,7 +25,7 @@ public async Task OnAuthorizationAsync(AuthorizationFilterContext context) if (string.IsNullOrEmpty(Permission)) return; - var permissionService = context.HttpContext.RequestServices.GetRequiredService(); + var permissionService = context.HttpContext.RequestServices.GetRequiredService(); //check whether current customer has access to a public store if (await permissionService.Authorize(Permission)) return; diff --git a/src/Web/Grand.Web.Common/Security/Authorization/RequestPermissionService.cs b/src/Web/Grand.Web.Common/Security/Authorization/RequestPermissionService.cs new file mode 100644 index 0000000000..b3df6cf541 --- /dev/null +++ b/src/Web/Grand.Web.Common/Security/Authorization/RequestPermissionService.cs @@ -0,0 +1,28 @@ +using Grand.Business.Common.Services.Security; +using Grand.Business.Core.Interfaces.Common.Directory; +using Grand.Data; +using Grand.Domain.Permissions; +using Grand.Infrastructure; +using Grand.Infrastructure.Caching; + +namespace Grand.Web.Common.Security.Authorization; + +public class RequestPermissionService( + IRepository permissionRepository, + IRepository permissionActionRepository, + IGroupService groupService, + ICacheBase cacheBase, + IContextAccessor contextAccessor) + : PermissionService(permissionRepository, permissionActionRepository, groupService, cacheBase), + IRequestPermissionService +{ + public Task Authorize(Permission permission) + { + return Authorize(permission, contextAccessor.WorkContext?.CurrentCustomer); + } + + public Task Authorize(string permissionSystemName) + { + return Authorize(permissionSystemName, contextAccessor.WorkContext?.CurrentCustomer); + } +} diff --git a/src/Web/Grand.Web.Common/Startup/StartupApplication.cs b/src/Web/Grand.Web.Common/Startup/StartupApplication.cs index a917420773..72ed2561eb 100644 --- a/src/Web/Grand.Web.Common/Startup/StartupApplication.cs +++ b/src/Web/Grand.Web.Common/Startup/StartupApplication.cs @@ -15,6 +15,7 @@ using Grand.Web.Common.Page; using Grand.Web.Common.RequestCustomerResolvers; using Grand.Web.Common.Routing; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Common.Security.Captcha; using Grand.Web.Common.TagHelpers; using Grand.Web.Common.Themes; @@ -120,6 +121,7 @@ private static void RegisterFramework(IServiceCollection serviceCollection) serviceCollection.AddScoped(); serviceCollection.AddScoped(); + serviceCollection.AddScoped(); serviceCollection.AddScoped(); if (DataSettingsManager.DatabaseIsInstalled()) { diff --git a/src/Web/Grand.Web.Store/Areas/Store/Views/Home/Index.cshtml b/src/Web/Grand.Web.Store/Areas/Store/Views/Home/Index.cshtml index 52fdf0e120..33c64936d4 100644 --- a/src/Web/Grand.Web.Store/Areas/Store/Views/Home/Index.cshtml +++ b/src/Web/Grand.Web.Store/Areas/Store/Views/Home/Index.cshtml @@ -1,12 +1,12 @@ @using Grand.Business.Core.Interfaces.Catalog.Prices @using Grand.Business.Core.Interfaces.Common.Directory -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Business.Core.Interfaces.Customers @using Grand.Business.Core.Interfaces.System.Reports @using Grand.Domain.Permissions @using Grand.Domain.Customers @inject CustomerSettings customerSettings -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @inject ICustomerService customerService @inject IOrderReportService orderReportService @inject IPriceFormatter priceFormatter diff --git a/src/Web/Grand.Web.Store/Areas/Store/Views/Shared/Partials/Menu.cshtml b/src/Web/Grand.Web.Store/Areas/Store/Views/Shared/Partials/Menu.cshtml index 9d2a11ee0b..868a929bbf 100644 --- a/src/Web/Grand.Web.Store/Areas/Store/Views/Shared/Partials/Menu.cshtml +++ b/src/Web/Grand.Web.Store/Areas/Store/Views/Shared/Partials/Menu.cshtml @@ -1,9 +1,9 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Business.Core.Interfaces.System.Admin @using Grand.Domain.Permissions @using Grand.Web.Common.Menu @using Constants = Grand.SharedUIResources.Constants -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @inject IAdminSiteMapService adminSiteMapService @inject IEnumerable _adminMenuProviders @{ diff --git a/src/Web/Grand.Web.Store/Components/StoreBestsellersBriefReportByAmount.cs b/src/Web/Grand.Web.Store/Components/StoreBestsellersBriefReportByAmount.cs index b66ca880ab..9a9aada0bd 100644 --- a/src/Web/Grand.Web.Store/Components/StoreBestsellersBriefReportByAmount.cs +++ b/src/Web/Grand.Web.Store/Components/StoreBestsellersBriefReportByAmount.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Store.Components; public class StoreBestsellersBriefReportByAmountViewComponent : BaseStoreViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public StoreBestsellersBriefReportByAmountViewComponent(IPermissionService permissionService) + public StoreBestsellersBriefReportByAmountViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Store/Components/StoreBestsellersBriefReportByQuantity.cs b/src/Web/Grand.Web.Store/Components/StoreBestsellersBriefReportByQuantity.cs index f699514b09..e9cbb6b0ff 100644 --- a/src/Web/Grand.Web.Store/Components/StoreBestsellersBriefReportByQuantity.cs +++ b/src/Web/Grand.Web.Store/Components/StoreBestsellersBriefReportByQuantity.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Store.Components; public class StoreBestsellersBriefReportByQuantityViewComponent : BaseStoreViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public StoreBestsellersBriefReportByQuantityViewComponent(IPermissionService permissionService) + public StoreBestsellersBriefReportByQuantityViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Store/Components/StoreCustomerReportRegistered.cs b/src/Web/Grand.Web.Store/Components/StoreCustomerReportRegistered.cs index 48e66f706f..c255038a07 100644 --- a/src/Web/Grand.Web.Store/Components/StoreCustomerReportRegistered.cs +++ b/src/Web/Grand.Web.Store/Components/StoreCustomerReportRegistered.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Store.Components; public class StoreCustomerReportRegisteredViewComponent : BaseStoreViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public StoreCustomerReportRegisteredViewComponent(IPermissionService permissionService) + public StoreCustomerReportRegisteredViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Store/Components/StoreCustomerReportTimeChart.cs b/src/Web/Grand.Web.Store/Components/StoreCustomerReportTimeChart.cs index 2415c7397e..eebad08662 100644 --- a/src/Web/Grand.Web.Store/Components/StoreCustomerReportTimeChart.cs +++ b/src/Web/Grand.Web.Store/Components/StoreCustomerReportTimeChart.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Store.Components; public class StoreCustomerReportTimeChartViewComponent : BaseStoreViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public StoreCustomerReportTimeChartViewComponent(IPermissionService permissionService) + public StoreCustomerReportTimeChartViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Store/Components/StoreLatestOrder.cs b/src/Web/Grand.Web.Store/Components/StoreLatestOrder.cs index bf67c4d5b5..c0ba3469f1 100644 --- a/src/Web/Grand.Web.Store/Components/StoreLatestOrder.cs +++ b/src/Web/Grand.Web.Store/Components/StoreLatestOrder.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Store.Components; public class StoreLatestOrderViewComponent : BaseStoreViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public StoreLatestOrderViewComponent(IPermissionService permissionService) + public StoreLatestOrderViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Store/Components/StoreOrderAverageReport.cs b/src/Web/Grand.Web.Store/Components/StoreOrderAverageReport.cs index 134b8cab27..4bfd00c0ff 100644 --- a/src/Web/Grand.Web.Store/Components/StoreOrderAverageReport.cs +++ b/src/Web/Grand.Web.Store/Components/StoreOrderAverageReport.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Store.Components; public class StoreOrderAverageReportViewComponent : BaseStoreViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public StoreOrderAverageReportViewComponent(IPermissionService permissionService) + public StoreOrderAverageReportViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Store/Components/StoreOrderIncompleteReport.cs b/src/Web/Grand.Web.Store/Components/StoreOrderIncompleteReport.cs index 8379dcb4e1..5d18c01515 100644 --- a/src/Web/Grand.Web.Store/Components/StoreOrderIncompleteReport.cs +++ b/src/Web/Grand.Web.Store/Components/StoreOrderIncompleteReport.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Store.Components; public class StoreOrderIncompleteReportViewComponent : BaseStoreViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public StoreOrderIncompleteReportViewComponent(IPermissionService permissionService) + public StoreOrderIncompleteReportViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Store/Components/StoreOrderPeriodReport.cs b/src/Web/Grand.Web.Store/Components/StoreOrderPeriodReport.cs index f1fda49514..61a5affa0e 100644 --- a/src/Web/Grand.Web.Store/Components/StoreOrderPeriodReport.cs +++ b/src/Web/Grand.Web.Store/Components/StoreOrderPeriodReport.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Store.Components; public class StoreOrderPeriodReportViewComponent : BaseStoreViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public StoreOrderPeriodReportViewComponent(IPermissionService permissionService) + public StoreOrderPeriodReportViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Store/Components/StoreOrderTimeChart.cs b/src/Web/Grand.Web.Store/Components/StoreOrderTimeChart.cs index 6a6f234395..a753b72776 100644 --- a/src/Web/Grand.Web.Store/Components/StoreOrderTimeChart.cs +++ b/src/Web/Grand.Web.Store/Components/StoreOrderTimeChart.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Store.Components; public class StoreOrderTimeChartViewComponent : BaseStoreViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public StoreOrderTimeChartViewComponent(IPermissionService permissionService) + public StoreOrderTimeChartViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Store/Controllers/PictureController.cs b/src/Web/Grand.Web.Store/Controllers/PictureController.cs index cbd10e65b5..109234ffd7 100644 --- a/src/Web/Grand.Web.Store/Controllers/PictureController.cs +++ b/src/Web/Grand.Web.Store/Controllers/PictureController.cs @@ -1,8 +1,8 @@ -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Storage; using Grand.Domain.Media; using Grand.Web.AdminShared.Controllers; using Grand.Web.Common.Filters; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Store.Extensions; using Microsoft.AspNetCore.Mvc; @@ -14,7 +14,7 @@ namespace Grand.Web.Store.Controllers; [AuthorizeMenu] public class PictureController( IPictureService pictureService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IMediaFileStore mediaFileStore, MediaSettings mediaSettings) : BasePictureController(pictureService, permissionService, mediaFileStore, mediaSettings) diff --git a/src/Web/Grand.Web.Store/Controllers/ProductController.cs b/src/Web/Grand.Web.Store/Controllers/ProductController.cs index 096aaa71bb..7edf79babf 100644 --- a/src/Web/Grand.Web.Store/Controllers/ProductController.cs +++ b/src/Web/Grand.Web.Store/Controllers/ProductController.cs @@ -1,7 +1,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Common.Directory; using Grand.Business.Core.Interfaces.Common.Localization; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.ExportImport; using Grand.Business.Core.Interfaces.Storage; using Grand.Domain.Catalog; @@ -9,6 +8,7 @@ using Grand.Web.AdminShared.Interfaces; using Grand.Web.Common.Filters; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Store.Extensions; using Microsoft.AspNetCore.Mvc; @@ -27,7 +27,7 @@ public class ProductController( IProductReservationService productReservationService, IAuctionService auctionService, IDateTimeService dateTimeService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IEnumTranslationService enumTranslationService, IAdminDataScope scope) : BaseProductController(productViewModelService, productService, inventoryManageService, languageService, diff --git a/src/Web/Grand.Web.Store/Controllers/ReportsController.cs b/src/Web/Grand.Web.Store/Controllers/ReportsController.cs index b22d59d467..cb515f030c 100644 --- a/src/Web/Grand.Web.Store/Controllers/ReportsController.cs +++ b/src/Web/Grand.Web.Store/Controllers/ReportsController.cs @@ -2,7 +2,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Checkout.Orders; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Common.Stores; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Interfaces.System.Reports; @@ -43,7 +42,7 @@ public class ReportsController( IReportDataScope scope, IOrderService orderService, ICustomerReportService customerReportService, - IPermissionService permissionService) + IRequestPermissionService permissionService) : BaseFullReportsController(orderReportService, productsReportService, customerReportViewModelService, priceFormatter, currencyService, productService, productAttributeFormatter, stockQuantityService, translationService, storeService, countryService, vendorService, dateTimeService, orderStatusService, diff --git a/src/Web/Grand.Web.Vendor/Areas/Vendor/Views/Shared/Partials/Menu.cshtml b/src/Web/Grand.Web.Vendor/Areas/Vendor/Views/Shared/Partials/Menu.cshtml index dc9f70af6a..1e365a24e0 100644 --- a/src/Web/Grand.Web.Vendor/Areas/Vendor/Views/Shared/Partials/Menu.cshtml +++ b/src/Web/Grand.Web.Vendor/Areas/Vendor/Views/Shared/Partials/Menu.cshtml @@ -1,9 +1,9 @@ -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Business.Core.Interfaces.System.Admin @using Grand.Domain.Permissions @using Grand.Web.Common.Menu @using Constants = Grand.SharedUIResources.Constants -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @inject IAdminSiteMapService adminSiteMapService @inject IEnumerable _adminMenuProviders @{ diff --git a/src/Web/Grand.Web.Vendor/Components/LatestVendorOrder.cs b/src/Web/Grand.Web.Vendor/Components/LatestVendorOrder.cs index 4bdabf4f28..cdc2f40000 100644 --- a/src/Web/Grand.Web.Vendor/Components/LatestVendorOrder.cs +++ b/src/Web/Grand.Web.Vendor/Components/LatestVendorOrder.cs @@ -1,15 +1,15 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Microsoft.AspNetCore.Mvc; namespace Grand.Web.Vendor.Components; public class LatestVendorOrderViewComponent : BaseVendorViewComponent { - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; - public LatestVendorOrderViewComponent(IPermissionService permissionService) + public LatestVendorOrderViewComponent(IRequestPermissionService permissionService) { _permissionService = permissionService; } diff --git a/src/Web/Grand.Web.Vendor/Controllers/ProductController.cs b/src/Web/Grand.Web.Vendor/Controllers/ProductController.cs index 99c7532633..62dc8ae266 100644 --- a/src/Web/Grand.Web.Vendor/Controllers/ProductController.cs +++ b/src/Web/Grand.Web.Vendor/Controllers/ProductController.cs @@ -1,7 +1,6 @@ using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Common.Directory; using Grand.Business.Core.Interfaces.Common.Localization; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Catalog; using Grand.Infrastructure; using Grand.Web.AdminShared.Controllers; @@ -9,6 +8,7 @@ using Grand.Web.AdminShared.Models.Catalog; using Grand.Web.Common.Filters; using Grand.Web.Common.Localization; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Vendor.Extensions; using Microsoft.AspNetCore.Mvc; @@ -27,7 +27,7 @@ public class ProductController( IProductReservationService productReservationService, IAuctionService auctionService, IDateTimeService dateTimeService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IEnumTranslationService enumTranslationService, IAdminDataScope scope, IContextAccessor contextAccessor) diff --git a/src/Web/Grand.Web/Components/EmailWishlist.cs b/src/Web/Grand.Web/Components/EmailWishlist.cs index 774a069a7b..0c95e5fcf3 100644 --- a/src/Web/Grand.Web/Components/EmailWishlist.cs +++ b/src/Web/Grand.Web/Components/EmailWishlist.cs @@ -1,10 +1,10 @@ using Grand.Business.Core.Interfaces.Checkout.Orders; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Common; using Grand.Domain.Orders; using Grand.Domain.Permissions; using Grand.Infrastructure; using Grand.Web.Common.Components; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Models.ShoppingCart; using Microsoft.AspNetCore.Mvc; using Grand.Web.Common.Extensions; @@ -14,7 +14,7 @@ namespace Grand.Web.Components; public class EmailWishlistViewComponent : BaseViewComponent { private readonly CaptchaSettings _captchaSettings; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IShoppingCartService _shoppingCartService; private readonly ShoppingCartSettings _shoppingCartSettings; private readonly IContextAccessor _contextAccessor; @@ -22,7 +22,7 @@ public class EmailWishlistViewComponent : BaseViewComponent public EmailWishlistViewComponent( IContextAccessor contextAccessor, IShoppingCartService shoppingCartService, - IPermissionService permissionService, + IRequestPermissionService permissionService, ShoppingCartSettings shoppingCartSettings, CaptchaSettings captchaSettings ) diff --git a/src/Web/Grand.Web/Components/Footer.cs b/src/Web/Grand.Web/Components/Footer.cs index 368b1cdc03..a41359651f 100644 --- a/src/Web/Grand.Web/Components/Footer.cs +++ b/src/Web/Grand.Web/Components/Footer.cs @@ -1,6 +1,5 @@ using Grand.Business.Core.Extensions; using Grand.Business.Core.Interfaces.Cms; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Domain.Blogs; using Grand.Domain.Catalog; @@ -13,6 +12,7 @@ using Grand.Infrastructure; using Grand.Web.Common.Components; using Grand.Web.Common.Extensions; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Models.Common; using Microsoft.AspNetCore.Mvc; @@ -26,7 +26,7 @@ public class FooterViewComponent : BaseViewComponent private readonly KnowledgebaseSettings _knowledgebaseSettings; private readonly NewsSettings _newsSettings; private readonly IPageService _pageService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly StoreInformationSettings _storeInformationSettings; private readonly VendorSettings _vendorSettings; @@ -35,7 +35,7 @@ public class FooterViewComponent : BaseViewComponent public FooterViewComponent( IContextAccessor contextAccessor, IPageService pageService, - IPermissionService permissionService, + IRequestPermissionService permissionService, StoreInformationSettings storeInformationSettings, CatalogSettings catalogSettings, BlogSettings blogSettings, diff --git a/src/Web/Grand.Web/Controllers/BlogController.cs b/src/Web/Grand.Web/Controllers/BlogController.cs index f283d27b90..480db86d8e 100644 --- a/src/Web/Grand.Web/Controllers/BlogController.cs +++ b/src/Web/Grand.Web/Controllers/BlogController.cs @@ -8,6 +8,7 @@ using Grand.Web.Commands.Models.Blogs; using Grand.Web.Common.Controllers; using Grand.Web.Common.Filters; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Events; using Grand.Web.Features.Models.Blogs; using Grand.Web.Models.Blogs; @@ -104,7 +105,7 @@ public virtual async Task> BlogByKeyword(BlogPag [HttpGet] public virtual async Task> BlogPost(string blogPostId, [FromServices] IAclService aclService, - [FromServices] IPermissionService permissionService) + [FromServices] IRequestPermissionService permissionService) { if (!_blogSettings.Enabled) return RedirectToRoute("HomePage"); diff --git a/src/Web/Grand.Web/Controllers/KnowledgebaseController.cs b/src/Web/Grand.Web/Controllers/KnowledgebaseController.cs index 018ffc09c5..6fe7bb133b 100644 --- a/src/Web/Grand.Web/Controllers/KnowledgebaseController.cs +++ b/src/Web/Grand.Web/Controllers/KnowledgebaseController.cs @@ -15,6 +15,7 @@ using Grand.Web.Common.Controllers; using Grand.Web.Common.Extensions; using Grand.Web.Common.Filters; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Events.Cache; using Grand.Web.Extensions; using Grand.Web.Models.Knowledgebase; @@ -35,7 +36,7 @@ public class KnowledgebaseController : BasePublicController private readonly KnowledgebaseSettings _knowledgebaseSettings; private readonly LanguageSettings _languageSettings; private readonly IMessageProviderService _messageProviderService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IRequestTranslationService _translationService; private readonly IContextAccessor _contextAccessor; @@ -48,7 +49,7 @@ public KnowledgebaseController( IRequestTranslationService translationService, IMessageProviderService messageProviderService, IDateTimeService dateTimeService, - IPermissionService permissionService, + IRequestPermissionService permissionService, CustomerSettings customerSettings, CaptchaSettings captchaSettings, LanguageSettings languageSettings) diff --git a/src/Web/Grand.Web/Controllers/NewsController.cs b/src/Web/Grand.Web/Controllers/NewsController.cs index e8db830814..9d203ac068 100644 --- a/src/Web/Grand.Web/Controllers/NewsController.cs +++ b/src/Web/Grand.Web/Controllers/NewsController.cs @@ -8,6 +8,7 @@ using Grand.Web.Commands.Models.News; using Grand.Web.Common.Controllers; using Grand.Web.Common.Filters; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Events; using Grand.Web.Features.Models.News; using Grand.Web.Models.News; @@ -27,7 +28,7 @@ public NewsController(INewsService newsService, IContextAccessor contextAccessor, IRequestTranslationService translationService, IAclService aclService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IMediator mediator, NewsSettings newsSettings) { @@ -48,7 +49,7 @@ public NewsController(INewsService newsService, private readonly IContextAccessor _contextAccessor; private readonly IRequestTranslationService _translationService; private readonly IAclService _aclService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IMediator _mediator; private readonly NewsSettings _newsSettings; diff --git a/src/Web/Grand.Web/Controllers/PageController.cs b/src/Web/Grand.Web/Controllers/PageController.cs index 1e7f613539..4bad099849 100644 --- a/src/Web/Grand.Web/Controllers/PageController.cs +++ b/src/Web/Grand.Web/Controllers/PageController.cs @@ -1,8 +1,8 @@ -using Grand.Business.Core.Interfaces.Common.Security; -using Grand.Domain.Permissions; +using Grand.Domain.Permissions; using Grand.SharedKernel.Attributes; using Grand.Web.Common.Controllers; using Grand.Web.Common.Filters; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Features.Models.Pages; using Grand.Web.Models.Pages; using Grand.Mediator; @@ -18,7 +18,7 @@ public class PageController : BasePublicController public PageController( IRequestTranslationService translationService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IMediator mediator) { _translationService = translationService; @@ -31,7 +31,7 @@ public PageController( #region Fields private readonly IRequestTranslationService _translationService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IMediator _mediator; #endregion diff --git a/src/Web/Grand.Web/Controllers/ShoppingCartController.cs b/src/Web/Grand.Web/Controllers/ShoppingCartController.cs index 5f9c6283f1..c8f75e43ef 100644 --- a/src/Web/Grand.Web/Controllers/ShoppingCartController.cs +++ b/src/Web/Grand.Web/Controllers/ShoppingCartController.cs @@ -4,7 +4,6 @@ using Grand.Business.Core.Interfaces.Checkout.GiftVouchers; using Grand.Business.Core.Interfaces.Checkout.Orders; using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Interfaces.Storage; using Grand.Domain.Permissions; @@ -20,6 +19,7 @@ using Grand.Web.Common.Controllers; using Grand.Web.Common.Extensions; using Grand.Web.Common.Filters; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Features.Models.ShoppingCart; using Grand.Web.Models.ShoppingCart; using Grand.Mediator; @@ -42,7 +42,7 @@ public ShoppingCartController( ICustomerService customerService, IGroupService groupService, ICheckoutAttributeService checkoutAttributeService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IMediator mediator, IShoppingCartValidator shoppingCartValidator, ShoppingCartSettings shoppingCartSettings, @@ -107,7 +107,7 @@ private ShoppingCartType[] PrepareCartTypes() private readonly ICustomerService _customerService; private readonly IGroupService _groupService; private readonly ICheckoutAttributeService _checkoutAttributeService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IMediator _mediator; private readonly IShoppingCartValidator _shoppingCartValidator; private readonly ShoppingCartSettings _shoppingCartSettings; diff --git a/src/Web/Grand.Web/Controllers/WishlistController.cs b/src/Web/Grand.Web/Controllers/WishlistController.cs index ea0ba28907..22dd2a7e29 100644 --- a/src/Web/Grand.Web/Controllers/WishlistController.cs +++ b/src/Web/Grand.Web/Controllers/WishlistController.cs @@ -1,5 +1,4 @@ using Grand.Business.Core.Interfaces.Checkout.Orders; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Customers; using Grand.Business.Core.Interfaces.Messages; using Grand.Business.Core.Utilities.Checkout; @@ -11,6 +10,7 @@ using Grand.SharedKernel.Extensions; using Grand.Web.Common.Controllers; using Grand.Web.Common.Filters; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Features.Models.ShoppingCart; using Grand.Web.Models.ShoppingCart; using Grand.Mediator; @@ -30,7 +30,7 @@ public WishlistController( IShoppingCartService shoppingCartService, IRequestTranslationService translationService, ICustomerService customerService, - IPermissionService permissionService, + IRequestPermissionService permissionService, IMediator mediator, ShoppingCartSettings shoppingCartSettings) { @@ -51,7 +51,7 @@ public WishlistController( private readonly IShoppingCartService _shoppingCartService; private readonly IRequestTranslationService _translationService; private readonly ICustomerService _customerService; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IMediator _mediator; private readonly ShoppingCartSettings _shoppingCartSettings; diff --git a/src/Web/Grand.Web/Features/Handlers/Products/GetProductDetailsAttributeChangeHandler.cs b/src/Web/Grand.Web/Features/Handlers/Products/GetProductDetailsAttributeChangeHandler.cs index 3bff4c33ae..e449819de0 100644 --- a/src/Web/Grand.Web/Features/Handlers/Products/GetProductDetailsAttributeChangeHandler.cs +++ b/src/Web/Grand.Web/Features/Handlers/Products/GetProductDetailsAttributeChangeHandler.cs @@ -1,7 +1,6 @@ using Grand.Business.Core.Interfaces.Catalog.Prices; using Grand.Business.Core.Interfaces.Catalog.Products; using Grand.Business.Core.Interfaces.Catalog.Tax; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Business.Core.Interfaces.Storage; using Grand.Domain.Permissions; using Grand.Domain.Catalog; @@ -10,6 +9,7 @@ using Grand.Domain.Orders; using Grand.Domain.Tax; using Grand.Infrastructure; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Extensions; using Grand.Web.Features.Models.Products; using Grand.Web.Features.Models.ShoppingCart; @@ -27,7 +27,7 @@ public class GetProductDetailsAttributeChangeHandler : IRequestHandler private readonly CatalogSettings _catalogSettings; private readonly LinkGenerator _linkGenerator; private readonly MediaSettings _mediaSettings; - private readonly IPermissionService _permissionService; + private readonly IRequestPermissionService _permissionService; private readonly IPictureService _pictureService; private readonly IPriceFormatter _priceFormatter; private readonly IPricingService _pricingService; @@ -42,7 +42,7 @@ public class GetWishlistHandler : IRequestHandler private readonly IRequestTranslationService _translationService; private readonly IEnumTranslationService _enumTranslationService; public GetWishlistHandler( - IPermissionService permissionService, + IRequestPermissionService permissionService, IProductService productService, IProductAttributeFormatter productAttributeFormatter, IRequestTranslationService translationService, diff --git a/src/Web/Grand.Web/Validators/ShoppingCart/UpdateQuantityValidator.cs b/src/Web/Grand.Web/Validators/ShoppingCart/UpdateQuantityValidator.cs index 1f62d25a34..938547cb16 100644 --- a/src/Web/Grand.Web/Validators/ShoppingCart/UpdateQuantityValidator.cs +++ b/src/Web/Grand.Web/Validators/ShoppingCart/UpdateQuantityValidator.cs @@ -1,10 +1,10 @@ using FluentValidation; using Grand.Business.Core.Interfaces.Checkout.Orders; -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Domain.Orders; using Grand.Infrastructure; using Grand.Infrastructure.Validators; +using Grand.Web.Common.Security.Authorization; using Grand.Web.Models.ShoppingCart; using Grand.Web.Common.Extensions; @@ -14,7 +14,7 @@ public class UpdateQuantityValidator : BaseGrandValidator { public UpdateQuantityValidator( IEnumerable> validators, - IPermissionService permissionService, ShoppingCartSettings shoppingCartSettings, + IRequestPermissionService permissionService, ShoppingCartSettings shoppingCartSettings, IShoppingCartService shoppingCartService, IContextAccessor contextAccessor) : base(validators) { diff --git a/src/Web/Grand.Web/Views/Shared/Partials/HeaderLinks.cshtml b/src/Web/Grand.Web/Views/Shared/Partials/HeaderLinks.cshtml index 6f729b477e..da7be4ecdc 100644 --- a/src/Web/Grand.Web/Views/Shared/Partials/HeaderLinks.cshtml +++ b/src/Web/Grand.Web/Views/Shared/Partials/HeaderLinks.cshtml @@ -1,10 +1,10 @@ @using Grand.Business.Core.Interfaces.Common.Directory -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @inject IGroupService groupService @inject IContextAccessor contextAccessor @inject IPageHeadBuilder pagebuilder -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @{ var registerUrl = Url.RouteUrl("Register", new { returnUrl = Context.Request.Query["returnUrl"] }); var isAuthenticated = await groupService.IsRegistered(contextAccessor.WorkContext.CurrentCustomer); diff --git a/src/Web/Grand.Web/Views/Shared/Partials/ShoppingCartLinks.cshtml b/src/Web/Grand.Web/Views/Shared/Partials/ShoppingCartLinks.cshtml index 54b99572b6..83cfca351e 100644 --- a/src/Web/Grand.Web/Views/Shared/Partials/ShoppingCartLinks.cshtml +++ b/src/Web/Grand.Web/Views/Shared/Partials/ShoppingCartLinks.cshtml @@ -1,8 +1,8 @@ @using Grand.Business.Core.Interfaces.Checkout.Orders -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @inject IContextAccessor contextAccessor -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @inject IShoppingCartService shoppingCartService @inject ShoppingCartSettings shoppingCartSettings @inject CatalogSettings catalogSettings diff --git a/src/Web/Grand.Web/Views/Shared/Partials/SidebarPanels.cshtml b/src/Web/Grand.Web/Views/Shared/Partials/SidebarPanels.cshtml index 8edf92d6ed..09c1733bd0 100644 --- a/src/Web/Grand.Web/Views/Shared/Partials/SidebarPanels.cshtml +++ b/src/Web/Grand.Web/Views/Shared/Partials/SidebarPanels.cshtml @@ -1,8 +1,8 @@ @using Grand.Business.Core.Interfaces.Checkout.Orders -@using Grand.Business.Core.Interfaces.Common.Security +@using Grand.Web.Common.Security.Authorization @using Grand.Domain.Permissions @inject IContextAccessor contextAccessor -@inject IPermissionService permissionService +@inject IRequestPermissionService permissionService @inject ShoppingCartSettings shoppingCartSettings @inject CatalogSettings catalogSettings @* From 02bc2d83988ee6973488bafc078f59aaff042b5e Mon Sep 17 00:00:00 2001 From: support Date: Sun, 18 Oct 2026 09:14:39 +0200 Subject: [PATCH 2/3] Narrow IRequestPermissionService to the request Authorize overloads IRequestPermissionService no longer extends IPermissionService, so request-side callers cannot create, update or delete permissions. RequestPermissionService delegates to the registered IPermissionService instead of inheriting PermissionService, so a replaced or decorated permission service also applies to Web filters, views and components. PermissionAuthorizeAction and CustomerGroupAclUpdateValidator take IPermissionService for AuthorizeAction and GetPermissionById, and a missing customer now denies access instead of throwing. API controllers read the caller through BaseApiController.CurrentCustomer rather than injecting IContextAccessor each, and the admin API filter tolerates a missing work context. --- .../Controllers/BaseApiController.cs | 11 +++- .../Controllers/BrandController.cs | 17 +++--- .../Controllers/BrandLayoutController.cs | 9 +-- .../Controllers/CategoryController.cs | 17 +++--- .../Controllers/CategoryLayoutController.cs | 9 +-- .../Controllers/CollectionController.cs | 17 +++--- .../Controllers/CollectionLayoutController.cs | 9 +-- .../Controllers/CountryController.cs | 9 +-- .../Controllers/CurrencyController.cs | 9 +-- .../Controllers/CustomerController.cs | 21 +++---- .../Controllers/CustomerGroupController.cs | 17 +++--- .../Controllers/DeliveryDateController.cs | 9 +-- .../Controllers/LanguageController.cs | 9 +-- .../Controllers/PickupPointController.cs | 9 +-- .../Controllers/PictureController.cs | 13 ++--- .../Controllers/ProductAttributeController.cs | 17 +++--- .../Controllers/ProductController.cs | 55 +++++++++---------- .../Controllers/ProductLayoutController.cs | 9 +-- .../Controllers/ShippingMethodController.cs | 9 +-- .../SpecificationAttributeController.cs | 17 +++--- .../Controllers/StoreController.cs | 9 +-- .../Controllers/VendorController.cs | 9 +-- .../Controllers/WarehouseController.cs | 9 +-- .../Filters/AuthorizeApiAdminAttribute.cs | 2 +- .../RequestPermissionServiceTests.cs | 30 +++------- .../Controllers/ContentPreviewTests.cs | 15 ++++- .../CustomerGroupAclUpdateValidator.cs | 6 +- .../IRequestPermissionService.cs | 5 +- .../PermissionAuthorizeActionAttribute.cs | 13 +++-- .../Authorization/RequestPermissionService.cs | 18 ++---- .../Controllers/KnowledgebaseController.cs | 9 ++- 31 files changed, 176 insertions(+), 241 deletions(-) diff --git a/src/Modules/Grand.Module.Api/Controllers/BaseApiController.cs b/src/Modules/Grand.Module.Api/Controllers/BaseApiController.cs index 2816e836b7..c46ffbe996 100644 --- a/src/Modules/Grand.Module.Api/Controllers/BaseApiController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/BaseApiController.cs @@ -1,9 +1,12 @@ -using Grand.Module.Api.Attributes; +using Grand.Domain.Customers; +using Grand.Infrastructure; +using Grand.Module.Api.Attributes; using Grand.Module.Api.Constants; using Grand.Module.Api.Filters; using Microsoft.AspNetCore.Authentication.JwtBearer; using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; +using Microsoft.Extensions.DependencyInjection; namespace Grand.Module.Api.Controllers; @@ -15,6 +18,12 @@ namespace Grand.Module.Api.Controllers; [Produces("application/json")] public abstract class BaseApiController : ControllerBase { + /// + /// Customer of the current request + /// + protected Customer CurrentCustomer => + HttpContext.RequestServices.GetRequiredService().WorkContext?.CurrentCustomer; + public override ForbidResult Forbid() { return new ForbidResult(JwtBearerDefaults.AuthenticationScheme); diff --git a/src/Modules/Grand.Module.Api/Controllers/BrandController.cs b/src/Modules/Grand.Module.Api/Controllers/BrandController.cs index 00a501b6da..b3ffaf6358 100644 --- a/src/Modules/Grand.Module.Api/Controllers/BrandController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/BrandController.cs @@ -10,7 +10,6 @@ using Microsoft.AspNetCore.Http; using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -18,13 +17,11 @@ public class BrandController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public BrandController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public BrandController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entities from Brand")] @@ -35,7 +32,7 @@ public BrandController(IMediator mediator, IPermissionService permissionService, [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -48,7 +45,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(BrandDto))] public async Task GetById([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, CurrentCustomer)) return Forbid(); var brand = await _mediator.Send(new GetGenericQuery(key)); if (!brand.Any()) return NotFound(); @@ -64,7 +61,7 @@ public async Task GetById([FromRoute] string key) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] BrandDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddBrandCommand { Model = model }); return Ok(model); @@ -78,7 +75,7 @@ public async Task Post([FromBody] BrandDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] BrandDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateBrandCommand { Model = model }); return Ok(model); @@ -103,7 +100,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, CurrentCustomer)) return Forbid(); var brand = await _mediator.Send(new GetGenericQuery(key)); if (!brand.Any()) return NotFound(); @@ -122,7 +119,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Brands, CurrentCustomer)) return Forbid(); var brand = await _mediator.Send(new GetGenericQuery(key)); if (!brand.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/BrandLayoutController.cs b/src/Modules/Grand.Module.Api/Controllers/BrandLayoutController.cs index 4a6049cec8..9396c2bbaf 100644 --- a/src/Modules/Grand.Module.Api/Controllers/BrandLayoutController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/BrandLayoutController.cs @@ -8,7 +8,6 @@ using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class BrandLayoutController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public BrandLayoutController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public BrandLayoutController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from BrandLayout by key")] @@ -33,7 +30,7 @@ public BrandLayoutController(IMediator mediator, IPermissionService permissionSe [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, CurrentCustomer)) return Forbid(); var layout = await _mediator.Send(new GetGenericQuery(key)); if (!layout.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/CategoryController.cs b/src/Modules/Grand.Module.Api/Controllers/CategoryController.cs index 389ed71730..cb12e8b370 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CategoryController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CategoryController.cs @@ -10,7 +10,6 @@ using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -18,15 +17,13 @@ public class CategoryController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; public CategoryController( IMediator mediator, - IPermissionService permissionService, IContextAccessor contextAccessor) + IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Category by key")] @@ -37,7 +34,7 @@ public CategoryController( [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, CurrentCustomer)) return Forbid(); var category = await _mediator.Send(new GetGenericQuery(key)); if (!category.Any()) return NotFound(); @@ -53,7 +50,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -66,7 +63,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] CategoryDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddCategoryCommand { Model = model }); return Ok(model); @@ -80,7 +77,7 @@ public async Task Post([FromBody] CategoryDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] CategoryDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateCategoryCommand { Model = model }); return Ok(model); @@ -98,7 +95,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, CurrentCustomer)) return Forbid(); var category = await _mediator.Send(new GetGenericQuery(key)); if (!category.Any()) return NotFound(); @@ -117,7 +114,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Categories, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Categories, CurrentCustomer)) return Forbid(); var category = await _mediator.Send(new GetGenericQuery(key)); if (!category.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/CategoryLayoutController.cs b/src/Modules/Grand.Module.Api/Controllers/CategoryLayoutController.cs index cb26f48eeb..d18a6e75f2 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CategoryLayoutController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CategoryLayoutController.cs @@ -8,7 +8,6 @@ using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,15 +15,13 @@ public class CategoryLayoutController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; public CategoryLayoutController( IMediator mediator, - IPermissionService permissionService, IContextAccessor contextAccessor) + IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from CategoryLayout by key")] @@ -35,7 +32,7 @@ public CategoryLayoutController( [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, CurrentCustomer)) return Forbid(); var layout = await _mediator.Send(new GetGenericQuery(key)); if (!layout.Any()) return NotFound(); @@ -51,7 +48,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/CollectionController.cs b/src/Modules/Grand.Module.Api/Controllers/CollectionController.cs index 455f950d6f..371e2f4675 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CollectionController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CollectionController.cs @@ -10,7 +10,6 @@ using Microsoft.AspNetCore.JsonPatch.SystemTextJson; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -18,13 +17,11 @@ public class CollectionController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public CollectionController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public CollectionController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Collection by key")] @@ -35,7 +32,7 @@ public CollectionController(IMediator mediator, IPermissionService permissionSer [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, CurrentCustomer)) return Forbid(); var collection = await _mediator.Send(new GetGenericQuery(key)); if (!collection.Any()) return NotFound(); @@ -51,7 +48,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -64,7 +61,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] CollectionDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddCollectionCommand { Model = model }); return Ok(model); @@ -78,7 +75,7 @@ public async Task Post([FromBody] CollectionDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] CollectionDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateCollectionCommand { Model = model }); return Ok(model); @@ -96,7 +93,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, CurrentCustomer)) return Forbid(); var collection = await _mediator.Send(new GetGenericQuery(key)); if (!collection.Any()) return NotFound(); @@ -115,7 +112,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Collections, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Collections, CurrentCustomer)) return Forbid(); var collection = await _mediator.Send(new GetGenericQuery(key)); if (!collection.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/CollectionLayoutController.cs b/src/Modules/Grand.Module.Api/Controllers/CollectionLayoutController.cs index bf2df44cd9..ffa80203cd 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CollectionLayoutController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CollectionLayoutController.cs @@ -8,7 +8,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class CollectionLayoutController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public CollectionLayoutController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public CollectionLayoutController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from CollectionLayout by key")] @@ -33,7 +30,7 @@ public CollectionLayoutController(IMediator mediator, IPermissionService permiss [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, CurrentCustomer)) return Forbid(); var layout = await _mediator.Send(new GetGenericQuery(key)); if (!layout.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/CountryController.cs b/src/Modules/Grand.Module.Api/Controllers/CountryController.cs index d861eed7cf..af6b8f021b 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CountryController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CountryController.cs @@ -8,7 +8,6 @@ using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class CountryController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public CountryController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public CountryController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Country by key")] @@ -33,7 +30,7 @@ public CountryController(IMediator mediator, IPermissionService permissionServic [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Countries, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Countries, CurrentCustomer)) return Forbid(); //Domain.Directory.Country var country = await _mediator.Send(new GetGenericQuery(key)); @@ -50,7 +47,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Countries, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Countries, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/CurrencyController.cs b/src/Modules/Grand.Module.Api/Controllers/CurrencyController.cs index b7f86d779a..31e30b1eff 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CurrencyController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CurrencyController.cs @@ -8,7 +8,6 @@ using Grand.Module.Api.Attributes; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class CurrencyController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public CurrencyController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public CurrencyController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Currency by key")] @@ -33,7 +30,7 @@ public CurrencyController(IMediator mediator, IPermissionService permissionServi [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Currencies, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Currencies, CurrentCustomer)) return Forbid(); var currency = await _mediator.Send(new GetGenericQuery(key)); if (!currency.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Currencies, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Currencies, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/CustomerController.cs b/src/Modules/Grand.Module.Api/Controllers/CustomerController.cs index 699bf2e431..36fa26779e 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CustomerController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CustomerController.cs @@ -10,7 +10,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -21,11 +20,10 @@ public class CustomerController : BaseApiController private readonly CustomerSettings _customerSettings; private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; public CustomerController( IMediator mediator, - IPermissionService permissionService, IContextAccessor contextAccessor, + IPermissionService permissionService, ICustomerManagerService customerManagerService, CustomerSettings customerSettings) { @@ -33,7 +31,6 @@ public CustomerController( _customerManagerService = customerManagerService; _customerSettings = customerSettings; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Customer by email")] @@ -44,7 +41,7 @@ public CustomerController( [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string email) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); var customer = await _mediator.Send(new GetCustomerQuery { Email = email }); if (customer == null) return NotFound(); @@ -60,7 +57,7 @@ public async Task Get([FromRoute] string email) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] CustomerDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddCustomerCommand { Model = model }); return Ok(model); @@ -74,7 +71,7 @@ public async Task Post([FromBody] CustomerDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] CustomerDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateCustomerCommand { Model = model }); return Ok(model); @@ -88,7 +85,7 @@ public async Task Put([FromBody] CustomerDto model) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string email) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); var customer = await _mediator.Send(new GetCustomerQuery { Email = email }); if (customer == null) return NotFound(); @@ -108,7 +105,7 @@ public async Task Delete([FromRoute] string email) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task AddAddress([FromRoute] string email, [FromBody] AddressDto address) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); var customer = await _mediator.Send(new GetCustomerQuery { Email = email }); if (customer == null) return NotFound(); @@ -127,7 +124,7 @@ public async Task AddAddress([FromRoute] string email, [FromBody] [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateAddress([FromRoute] string email, [FromBody] AddressDto address) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); var customer = await _mediator.Send(new GetCustomerQuery { Email = email }); if (customer == null) return NotFound(); @@ -147,7 +144,7 @@ public async Task UpdateAddress([FromRoute] string email, [FromBo [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteAddress([FromRoute] string email, [FromBody] DeleteAddressDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); if (model == null || string.IsNullOrEmpty(model.AddressId)) return NotFound(); @@ -173,7 +170,7 @@ public async Task DeleteAddress([FromRoute] string email, [FromBo [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task SetPassword([FromRoute] string email, [FromBody] PasswordDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); if (model == null || string.IsNullOrEmpty(model.Password)) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/CustomerGroupController.cs b/src/Modules/Grand.Module.Api/Controllers/CustomerGroupController.cs index d5321b95ad..64862fc8c0 100644 --- a/src/Modules/Grand.Module.Api/Controllers/CustomerGroupController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/CustomerGroupController.cs @@ -10,7 +10,6 @@ using Microsoft.AspNetCore.JsonPatch.SystemTextJson; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -18,13 +17,11 @@ public class CustomerGroupController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public CustomerGroupController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public CustomerGroupController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from CustomerGroup by key")] @@ -35,7 +32,7 @@ public CustomerGroupController(IMediator mediator, IPermissionService permission [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); var customerGroup = await _mediator.Send(new GetGenericQuery(key)); if (!customerGroup.Any()) return NotFound(); @@ -51,7 +48,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -64,7 +61,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] CustomerGroupDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddCustomerGroupCommand { Model = model }); return Ok(model); @@ -78,7 +75,7 @@ public async Task Post([FromBody] CustomerGroupDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] CustomerGroupDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); if (!model.IsSystem) { @@ -101,7 +98,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); var customerGroup = await _mediator.Send(new GetGenericQuery(key)); if (!customerGroup.Any()) return NotFound(); @@ -125,7 +122,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Customers, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Customers, CurrentCustomer)) return Forbid(); var customerGroup = await _mediator.Send(new GetGenericQuery(key)); if (!customerGroup.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/DeliveryDateController.cs b/src/Modules/Grand.Module.Api/Controllers/DeliveryDateController.cs index 8eaf108a0c..3dc88ac0ea 100644 --- a/src/Modules/Grand.Module.Api/Controllers/DeliveryDateController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/DeliveryDateController.cs @@ -8,7 +8,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class DeliveryDateController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public DeliveryDateController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public DeliveryDateController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Delivery Date by key")] @@ -33,7 +30,7 @@ public DeliveryDateController(IMediator mediator, IPermissionService permissionS [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, CurrentCustomer)) return Forbid(); var deliverydate = await _mediator.Send(new GetGenericQuery(key)); if (!deliverydate.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/LanguageController.cs b/src/Modules/Grand.Module.Api/Controllers/LanguageController.cs index 3cbf03a4cf..9b2365a463 100644 --- a/src/Modules/Grand.Module.Api/Controllers/LanguageController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/LanguageController.cs @@ -8,7 +8,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class LanguageController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public LanguageController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public LanguageController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Languages by key")] @@ -33,7 +30,7 @@ public LanguageController(IMediator mediator, IPermissionService permissionServi [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Languages, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Languages, CurrentCustomer)) return Forbid(); var language = await _mediator.Send(new GetGenericQuery(key)); if (!language.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Languages, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Languages, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/PickupPointController.cs b/src/Modules/Grand.Module.Api/Controllers/PickupPointController.cs index 55d99640b6..5bd95f9303 100644 --- a/src/Modules/Grand.Module.Api/Controllers/PickupPointController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/PickupPointController.cs @@ -8,7 +8,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class PickupPointController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public PickupPointController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public PickupPointController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from PickupPoint by key")] @@ -33,7 +30,7 @@ public PickupPointController(IMediator mediator, IPermissionService permissionSe [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, CurrentCustomer)) return Forbid(); var points = await _mediator.Send(new GetGenericQuery(key)); if (!points.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/PictureController.cs b/src/Modules/Grand.Module.Api/Controllers/PictureController.cs index 1a296c840b..28a04e2e83 100644 --- a/src/Modules/Grand.Module.Api/Controllers/PictureController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/PictureController.cs @@ -8,7 +8,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class PictureController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public PictureController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public PictureController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entities from Picture by key")] @@ -33,7 +30,7 @@ public PictureController(IMediator mediator, IPermissionService permissionServic [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Pictures, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Pictures, CurrentCustomer)) return Forbid(); var picture = await _mediator.Send(new GetGenericQuery(key)); if (picture == null || !picture.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] PictureDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Pictures, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Pictures, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddPictureCommand { PictureDto = model }); return Ok(model); @@ -63,7 +60,7 @@ public async Task Post([FromBody] PictureDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] PictureDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Pictures, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Pictures, CurrentCustomer)) return Forbid(); var result = await _mediator.Send(new UpdatePictureCommand { Model = model }); return Ok(result); @@ -77,7 +74,7 @@ public async Task Put([FromBody] PictureDto model) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Pictures, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Pictures, CurrentCustomer)) return Forbid(); var picture = await _mediator.Send(new GetGenericQuery(key)); if (picture == null || !picture.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/ProductAttributeController.cs b/src/Modules/Grand.Module.Api/Controllers/ProductAttributeController.cs index 718e3661e3..cd6d2a2f06 100644 --- a/src/Modules/Grand.Module.Api/Controllers/ProductAttributeController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/ProductAttributeController.cs @@ -10,7 +10,6 @@ using Microsoft.AspNetCore.JsonPatch.SystemTextJson; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -18,15 +17,13 @@ public class ProductAttributeController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; public ProductAttributeController( IMediator mediator, - IPermissionService permissionService, IContextAccessor contextAccessor) + IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from ProductAttribute by key")] @@ -37,7 +34,7 @@ public ProductAttributeController( [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, CurrentCustomer)) return Forbid(); var productAttribute = await _mediator.Send(new GetGenericQuery(key)); if (!productAttribute.Any()) return NotFound(); @@ -53,7 +50,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -66,7 +63,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] ProductAttributeDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddProductAttributeCommand { Model = model }); return Ok(model); @@ -80,7 +77,7 @@ public async Task Post([FromBody] ProductAttributeDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] ProductAttributeDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateProductAttributeCommand { Model = model }); return Ok(model); @@ -98,7 +95,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, CurrentCustomer)) return Forbid(); var productAttribute = await _mediator.Send(new GetGenericQuery(key)); if (!productAttribute.Any()) return NotFound(); @@ -117,7 +114,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ProductAttributes, CurrentCustomer)) return Forbid(); var productAttribute = await _mediator.Send(new GetGenericQuery(key)); if (!productAttribute.Any()) return NotFound(); diff --git a/src/Modules/Grand.Module.Api/Controllers/ProductController.cs b/src/Modules/Grand.Module.Api/Controllers/ProductController.cs index 40b8d6d34e..a779894ba4 100644 --- a/src/Modules/Grand.Module.Api/Controllers/ProductController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/ProductController.cs @@ -10,7 +10,6 @@ using Microsoft.AspNetCore.JsonPatch.SystemTextJson; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -18,15 +17,13 @@ public class ProductController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; public ProductController( IMediator mediator, - IPermissionService permissionService, IContextAccessor contextAccessor) + IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Product by key")] @@ -37,7 +34,7 @@ public ProductController( [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); var product = await _mediator.Send(new GetGenericQuery(key)); if (!product.Any()) return NotFound(); @@ -53,7 +50,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -66,7 +63,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] ProductDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddProductCommand { Model = model }); return Ok(model); @@ -80,7 +77,7 @@ public async Task Post([FromBody] ProductDto model) [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] ProductDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); await _mediator.Send(new UpdateProductCommand { Model = model }); return Ok(); @@ -95,7 +92,7 @@ public async Task Put([FromBody] ProductDto model) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Patch([FromRoute] string key, [FromBody] JsonPatchDocument model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); @@ -117,7 +114,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); var product = await _mediator.Send(new GetGenericQuery(key)); if (!product.Any()) return NotFound(); @@ -138,7 +135,7 @@ public async Task Delete([FromRoute] string key) [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateStock([FromRoute] string key, [FromBody] ProductUpdateStock model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); var product = await _mediator.Send(new GetGenericQuery(key)); if (!product.Any()) return NotFound(); @@ -161,7 +158,7 @@ public async Task UpdateStock([FromRoute] string key, [FromBody] [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductCategory([FromRoute] string key, [FromBody] ProductCategoryDto productCategory) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productCategory == null) return BadRequest(); @@ -190,7 +187,7 @@ public async Task CreateProductCategory([FromRoute] string key, [ [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductCategory([FromRoute] string key, [FromBody] ProductCategoryDto productCategory) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productCategory == null) return BadRequest(); @@ -219,7 +216,7 @@ public async Task UpdateProductCategory([FromRoute] string key, [ [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductCategory([FromRoute] string key, [FromBody] ProductCategoryDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); @@ -257,7 +254,7 @@ public async Task DeleteProductCategory([FromRoute] string key, [ [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductCollection([FromRoute] string key, [FromBody] ProductCollectionDto productCollection) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productCollection == null) return BadRequest(); @@ -285,7 +282,7 @@ public async Task CreateProductCollection([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductCollection([FromRoute] string key, [FromBody] ProductCollectionDto productCollection) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productCollection == null) return BadRequest(); @@ -314,7 +311,7 @@ public async Task UpdateProductCollection([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductCollection([FromRoute] string key, [FromBody] ProductCollectionDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); @@ -352,7 +349,7 @@ public async Task DeleteProductCollection([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductPicture([FromRoute] string key, [FromBody] ProductPictureDto productPicture) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productPicture == null) return BadRequest(); @@ -380,7 +377,7 @@ public async Task CreateProductPicture([FromRoute] string key, [F [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductPicture([FromRoute] string key, [FromBody] ProductPictureDto productPicture) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productPicture == null) return BadRequest(); @@ -408,7 +405,7 @@ public async Task UpdateProductPicture([FromRoute] string key, [F [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductPicture([FromRoute] string key, [FromBody] ProductPictureDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); @@ -446,7 +443,7 @@ public async Task DeleteProductPicture([FromRoute] string key, [F [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductSpecification([FromRoute] string key, [FromBody] ProductSpecificationAttributeDto productSpecification) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productSpecification == null) return BadRequest(); @@ -475,7 +472,7 @@ public async Task CreateProductSpecification([FromRoute] string k [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductSpecification([FromRoute] string key, [FromBody] ProductSpecificationAttributeDto productSpecification) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productSpecification == null) return BadRequest(); @@ -504,7 +501,7 @@ public async Task UpdateProductSpecification([FromRoute] string k [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductSpecification([FromRoute] string key, [FromBody] ProductSpecificationAttributeDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); @@ -543,7 +540,7 @@ public async Task DeleteProductSpecification([FromRoute] string k [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductTierPrice([FromRoute] string key, [FromBody] ProductTierPriceDto productTierPrice) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productTierPrice == null) return BadRequest(); @@ -571,7 +568,7 @@ public async Task CreateProductTierPrice([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductTierPrice([FromRoute] string key, [FromBody] ProductTierPriceDto productTierPrice) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productTierPrice == null) return BadRequest(); @@ -599,7 +596,7 @@ public async Task UpdateProductTierPrice([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductTierPrice([FromRoute] string key, [FromBody] ProductTierPriceDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); @@ -637,7 +634,7 @@ public async Task DeleteProductTierPrice([FromRoute] string key, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task CreateProductAttributeMapping([FromRoute] string key, [FromBody] ProductAttributeMappingDto productAttributeMapping) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productAttributeMapping == null) return BadRequest(); @@ -666,7 +663,7 @@ public async Task CreateProductAttributeMapping([FromRoute] strin [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task UpdateProductAttributeMapping([FromRoute] string key, [FromBody] ProductAttributeMappingDto productAttributeMapping) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (productAttributeMapping == null) return BadRequest(); @@ -695,7 +692,7 @@ public async Task UpdateProductAttributeMapping([FromRoute] strin [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteProductAttributeMapping([FromRoute] string key, [FromBody] ProductAttributeMappingDeleteDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.Products, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Products, CurrentCustomer)) return Forbid(); if (model == null) return BadRequest(); diff --git a/src/Modules/Grand.Module.Api/Controllers/ProductLayoutController.cs b/src/Modules/Grand.Module.Api/Controllers/ProductLayoutController.cs index 5d4972a38a..ed24c8554d 100644 --- a/src/Modules/Grand.Module.Api/Controllers/ProductLayoutController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/ProductLayoutController.cs @@ -9,7 +9,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -19,13 +18,11 @@ public class ProductLayoutController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public ProductLayoutController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public ProductLayoutController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from ProductLayout by key")] @@ -36,7 +33,7 @@ public ProductLayoutController(IMediator mediator, IPermissionService permission [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, CurrentCustomer)) return Forbid(); var layout = await _mediator.Send(new GetGenericQuery(key)); if (!layout.Any()) return NotFound(); @@ -52,7 +49,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Maintenance, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } } \ No newline at end of file diff --git a/src/Modules/Grand.Module.Api/Controllers/ShippingMethodController.cs b/src/Modules/Grand.Module.Api/Controllers/ShippingMethodController.cs index 30814e1bce..6a041b4347 100644 --- a/src/Modules/Grand.Module.Api/Controllers/ShippingMethodController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/ShippingMethodController.cs @@ -8,7 +8,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class ShippingMethodController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public ShippingMethodController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public ShippingMethodController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from ShippingMethod by key")] @@ -33,7 +30,7 @@ public ShippingMethodController(IMediator mediator, IPermissionService permissio [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, CurrentCustomer)) return Forbid(); var shipping = await _mediator.Send(new GetGenericQuery(key)); if (!shipping.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/SpecificationAttributeController.cs b/src/Modules/Grand.Module.Api/Controllers/SpecificationAttributeController.cs index f02d151e20..f8a6bb1e30 100644 --- a/src/Modules/Grand.Module.Api/Controllers/SpecificationAttributeController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/SpecificationAttributeController.cs @@ -10,7 +10,6 @@ using Microsoft.AspNetCore.JsonPatch.SystemTextJson; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -18,13 +17,11 @@ public class SpecificationAttributeController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public SpecificationAttributeController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public SpecificationAttributeController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from SpecificationAttribute by key")] @@ -35,7 +32,7 @@ public SpecificationAttributeController(IMediator mediator, IPermissionService p [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, CurrentCustomer)) return Forbid(); var specificationAttribute = await _mediator.Send(new GetGenericQuery(key)); if (!specificationAttribute.Any()) return NotFound(); @@ -51,7 +48,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } @@ -64,7 +61,7 @@ public async Task Get() [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Post([FromBody] SpecificationAttributeDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new AddSpecificationAttributeCommand { Model = model }); return Ok(model); @@ -78,7 +75,7 @@ public async Task Post([FromBody] SpecificationAttributeDto model [ProducesResponseType(StatusCodes.Status400BadRequest)] public async Task Put([FromBody] SpecificationAttributeDto model) { - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, CurrentCustomer)) return Forbid(); model = await _mediator.Send(new UpdateSpecificationAttributeCommand { Model = model }); return Ok(model); @@ -96,7 +93,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa if (string.IsNullOrEmpty(key)) return BadRequest("Key is null or empty"); - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, CurrentCustomer)) return Forbid(); var specification = await _mediator.Send(new GetGenericQuery(key)); if (!specification.Any()) return NotFound(); @@ -115,7 +112,7 @@ public async Task Patch([FromRoute] string key, [FromBody] JsonPa [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Delete([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.SpecificationAttributes, CurrentCustomer)) return Forbid(); var specification = await _mediator.Send(new GetGenericQuery(key)); diff --git a/src/Modules/Grand.Module.Api/Controllers/StoreController.cs b/src/Modules/Grand.Module.Api/Controllers/StoreController.cs index 058fd8d0b8..b1317f97f8 100644 --- a/src/Modules/Grand.Module.Api/Controllers/StoreController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/StoreController.cs @@ -8,7 +8,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class StoreController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public StoreController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public StoreController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Store by key")] @@ -33,7 +30,7 @@ public StoreController(IMediator mediator, IPermissionService permissionService, [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Stores, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Stores, CurrentCustomer)) return Forbid(); var store = await _mediator.Send(new GetGenericQuery(key)); if (!store.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Stores, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Stores, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/VendorController.cs b/src/Modules/Grand.Module.Api/Controllers/VendorController.cs index 198157f144..b79eb44bb2 100644 --- a/src/Modules/Grand.Module.Api/Controllers/VendorController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/VendorController.cs @@ -8,7 +8,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class VendorController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public VendorController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public VendorController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Vendor by key")] @@ -33,7 +30,7 @@ public VendorController(IMediator mediator, IPermissionService permissionService [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.Vendors, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Vendors, CurrentCustomer)) return Forbid(); var vendor = await _mediator.Send(new GetGenericQuery(key)); if (!vendor.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Vendors, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.Vendors, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Controllers/WarehouseController.cs b/src/Modules/Grand.Module.Api/Controllers/WarehouseController.cs index 105c07cac4..07bbeee56e 100644 --- a/src/Modules/Grand.Module.Api/Controllers/WarehouseController.cs +++ b/src/Modules/Grand.Module.Api/Controllers/WarehouseController.cs @@ -8,7 +8,6 @@ using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Routing; -using Grand.Infrastructure; namespace Grand.Module.Api.Controllers; @@ -16,13 +15,11 @@ public class WarehouseController : BaseApiController { private readonly IMediator _mediator; private readonly IPermissionService _permissionService; - private readonly IContextAccessor _contextAccessor; - public WarehouseController(IMediator mediator, IPermissionService permissionService, IContextAccessor contextAccessor) + public WarehouseController(IMediator mediator, IPermissionService permissionService) { _mediator = mediator; _permissionService = permissionService; - _contextAccessor = contextAccessor; } [EndpointDescription("Get entity from Warehouse by key")] @@ -33,7 +30,7 @@ public WarehouseController(IMediator mediator, IPermissionService permissionServ [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task Get([FromRoute] string key) { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, CurrentCustomer)) return Forbid(); var warehouse = await _mediator.Send(new GetGenericQuery(key)); if (!warehouse.Any()) return NotFound(); @@ -49,7 +46,7 @@ public async Task Get([FromRoute] string key) [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(IEnumerable))] public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, _contextAccessor.WorkContext.CurrentCustomer)) return Forbid(); + if (!await _permissionService.Authorize(PermissionSystemName.ShippingSettings, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); } diff --git a/src/Modules/Grand.Module.Api/Filters/AuthorizeApiAdminAttribute.cs b/src/Modules/Grand.Module.Api/Filters/AuthorizeApiAdminAttribute.cs index bbe8ff855e..334badb44d 100644 --- a/src/Modules/Grand.Module.Api/Filters/AuthorizeApiAdminAttribute.cs +++ b/src/Modules/Grand.Module.Api/Filters/AuthorizeApiAdminAttribute.cs @@ -75,7 +75,7 @@ public async Task OnAuthorizationAsync(AuthorizationFilterContext filterContext) { //authorize permission of access to the admin area if (!await permissionService.Authorize(StandardPermission.ManageAccessAdminPanel, - contextAccessor.WorkContext.CurrentCustomer)) + contextAccessor.WorkContext?.CurrentCustomer)) filterContext.Result = new ForbidResult(JwtBearerDefaults.AuthenticationScheme); //get allowed IP addresses diff --git a/src/Tests/Grand.Web.Common.Tests/Security/Authorization/RequestPermissionServiceTests.cs b/src/Tests/Grand.Web.Common.Tests/Security/Authorization/RequestPermissionServiceTests.cs index c5c692ce3d..a0db48c08c 100644 --- a/src/Tests/Grand.Web.Common.Tests/Security/Authorization/RequestPermissionServiceTests.cs +++ b/src/Tests/Grand.Web.Common.Tests/Security/Authorization/RequestPermissionServiceTests.cs @@ -1,9 +1,7 @@ -using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Data; +using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Customers; using Grand.Domain.Permissions; using Grand.Infrastructure; -using Grand.Infrastructure.Caching; using Grand.Web.Common.Security.Authorization; using Microsoft.VisualStudio.TestTools.UnitTesting; using Moq; @@ -14,17 +12,15 @@ namespace Grand.Web.Common.Tests.Security.Authorization; public class RequestPermissionServiceTests { private Mock _contextAccessorMock; - private Mock _serviceMock; + private Mock _permissionServiceMock; private RequestPermissionService _service; [TestInitialize] public void Init() { _contextAccessorMock = new Mock(); - _serviceMock = new Mock(Mock.Of>(), - Mock.Of>(), Mock.Of(), Mock.Of(), - _contextAccessorMock.Object) { CallBase = true }; - _service = _serviceMock.Object; + _permissionServiceMock = new Mock(); + _service = new RequestPermissionService(_permissionServiceMock.Object, _contextAccessorMock.Object); } [TestMethod] @@ -32,7 +28,7 @@ public async Task Authorize_SystemName_UsesCustomerOfTheRequest() { var customer = new Customer(); _contextAccessorMock.Setup(c => c.WorkContext.CurrentCustomer).Returns(customer); - _serviceMock.Setup(x => x.Authorize("ManageProducts", customer)).ReturnsAsync(true); + _permissionServiceMock.Setup(x => x.Authorize("ManageProducts", customer)).ReturnsAsync(true); Assert.IsTrue(await _service.Authorize("ManageProducts")); } @@ -43,27 +39,19 @@ public async Task Authorize_Permission_UsesCustomerOfTheRequest() var customer = new Customer(); var permission = new Permission { SystemName = "ManageProducts" }; _contextAccessorMock.Setup(c => c.WorkContext.CurrentCustomer).Returns(customer); - _serviceMock.Setup(x => x.Authorize(permission, customer)).ReturnsAsync(true); + _permissionServiceMock.Setup(x => x.Authorize(permission, customer)).ReturnsAsync(true); Assert.IsTrue(await _service.Authorize(permission)); } [TestMethod] - public async Task Authorize_WithoutWorkContext_ReturnsFalse() + public async Task Authorize_WithoutWorkContext_PassesNoCustomer() { _contextAccessorMock.Setup(c => c.WorkContext).Returns((IWorkContext)null); Assert.IsFalse(await _service.Authorize("ManageProducts")); Assert.IsFalse(await _service.Authorize(new Permission { SystemName = "ManageProducts" })); - } - - [TestMethod] - public async Task Authorize_WithCustomer_DoesNotReadTheRequest() - { - var customer = new Customer(); - _serviceMock.Setup(x => x.Authorize("ManageProducts", customer)).ReturnsAsync(true); - - Assert.IsTrue(await _service.Authorize("ManageProducts", customer)); - _contextAccessorMock.VerifyNoOtherCalls(); + _permissionServiceMock.Verify(x => x.Authorize("ManageProducts", null), Times.Once); + _permissionServiceMock.Verify(x => x.Authorize(It.IsAny(), null), Times.Once); } } diff --git a/src/Tests/Grand.Web.Tests/Controllers/ContentPreviewTests.cs b/src/Tests/Grand.Web.Tests/Controllers/ContentPreviewTests.cs index 8d86ba439a..fc500e5a70 100644 --- a/src/Tests/Grand.Web.Tests/Controllers/ContentPreviewTests.cs +++ b/src/Tests/Grand.Web.Tests/Controllers/ContentPreviewTests.cs @@ -14,6 +14,7 @@ using Grand.Infrastructure; using Grand.Infrastructure.Caching; using Grand.Mediator; +using Grand.Web.Common.Page; using Grand.Web.Common.Security.Authorization; using Grand.Web.Controllers; using Grand.Web.Features.Handlers.Pages; @@ -24,6 +25,8 @@ using Grand.Web.Models.News; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Mvc.ViewFeatures; +using Microsoft.Extensions.DependencyInjection; using Microsoft.VisualStudio.TestTools.UnitTesting; using Moq; using Grand.Web.Common.Localization; @@ -71,9 +74,11 @@ public void Init() .ReturnsAsync(new BlogPostModel()); } - private static ControllerContext GetContext() + private static ControllerContext GetContext(IServiceProvider requestServices = null) { - return new ControllerContext { HttpContext = new DefaultHttpContext { Request = { Method = "GET" } } }; + return new ControllerContext { + HttpContext = new DefaultHttpContext { Request = { Method = "GET" }, RequestServices = requestServices } + }; } private NewsController NewsController(NewsItem newsItem) @@ -105,7 +110,11 @@ private KnowledgebaseController KnowledgebaseController(KnowledgebaseArticle art _aclServiceMock.Object, new Mock().Object, new Mock().Object, new Mock().Object, _permissionServiceMock.Object, new CustomerSettings(), new CaptchaSettings(), new LanguageSettings()) { - ControllerContext = GetContext() + ControllerContext = GetContext(new ServiceCollection() + .AddSingleton(new Mock().Object) + .BuildServiceProvider()), + Url = new Mock().Object, + TempData = new Mock().Object }; } diff --git a/src/Web/Grand.Web.AdminShared/Validators/Customers/CustomerGroupAclUpdateValidator.cs b/src/Web/Grand.Web.AdminShared/Validators/Customers/CustomerGroupAclUpdateValidator.cs index 106b41dd1c..7954f03858 100644 --- a/src/Web/Grand.Web.AdminShared/Validators/Customers/CustomerGroupAclUpdateValidator.cs +++ b/src/Web/Grand.Web.AdminShared/Validators/Customers/CustomerGroupAclUpdateValidator.cs @@ -1,5 +1,6 @@ using FluentValidation; using Grand.Business.Core.Interfaces.Common.Directory; +using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Infrastructure.Validators; using Grand.Web.AdminShared.Models.Customers; @@ -10,12 +11,13 @@ namespace Grand.Web.AdminShared.Validators.Customers; public class CustomerGroupAclUpdateValidator : BaseGrandValidator { public CustomerGroupAclUpdateValidator(IEnumerable> validators, - IGroupService groupService, IRequestPermissionService permissionService) + IGroupService groupService, IPermissionService permissionService, + IRequestPermissionService requestPermissionService) : base(validators) { RuleFor(x => x).CustomAsync(async (x, context, _) => { - if (!await permissionService.Authorize(StandardPermission.ManageAcl)) + if (!await requestPermissionService.Authorize(StandardPermission.ManageAcl)) context.AddFailure("You don't have permission to the update"); var customerGroup = await groupService.GetCustomerGroupById(x.CustomerGroupId); diff --git a/src/Web/Grand.Web.Common/Security/Authorization/IRequestPermissionService.cs b/src/Web/Grand.Web.Common/Security/Authorization/IRequestPermissionService.cs index f91323c95e..1b6054f942 100644 --- a/src/Web/Grand.Web.Common/Security/Authorization/IRequestPermissionService.cs +++ b/src/Web/Grand.Web.Common/Security/Authorization/IRequestPermissionService.cs @@ -1,12 +1,11 @@ -using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; namespace Grand.Web.Common.Security.Authorization; /// -/// Permission service for code that runs inside a request +/// Permission checks for the customer of the current request /// -public interface IRequestPermissionService : IPermissionService +public interface IRequestPermissionService { /// /// Authorizes the customer of the current request. diff --git a/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs b/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs index c4b7559848..48d6428e4c 100644 --- a/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs +++ b/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs @@ -1,4 +1,5 @@ -using Grand.Domain.Permissions; +using Grand.Business.Core.Interfaces.Common.Security; +using Grand.Domain.Permissions; using Grand.Infrastructure; using Grand.Web.Common.DataSource; using Microsoft.AspNetCore.Mvc; @@ -34,16 +35,18 @@ public async Task OnAuthorizationAsync(AuthorizationFilterContext context) if (permissionAuthorize == null || string.IsNullOrEmpty(permissionAuthorize.Permission)) return; - var permissionService = context.HttpContext.RequestServices.GetRequiredService(); + var permissionService = context.HttpContext.RequestServices.GetRequiredService(); + var requestPermissionService = context.HttpContext.RequestServices.GetRequiredService(); var contextAccessor = context.HttpContext.RequestServices.GetRequiredService(); //check whether current customer has access to a public store - if (await permissionService.AuthorizeAction(permissionAuthorize.Permission, PermissionAction, - contextAccessor.WorkContext.CurrentCustomer)) + var customer = contextAccessor.WorkContext?.CurrentCustomer; + if (customer != null && + await permissionService.AuthorizeAction(permissionAuthorize.Permission, PermissionAction, customer)) return; //authorize permission of access to the admin area - if (!await permissionService.Authorize(StandardPermission.ManageAccessAdminPanel)) + if (!await requestPermissionService.Authorize(StandardPermission.ManageAccessAdminPanel)) { context.Result = new RedirectToRouteResult("AdminLogin", new RouteValueDictionary()); } diff --git a/src/Web/Grand.Web.Common/Security/Authorization/RequestPermissionService.cs b/src/Web/Grand.Web.Common/Security/Authorization/RequestPermissionService.cs index b3df6cf541..6eb1969d3b 100644 --- a/src/Web/Grand.Web.Common/Security/Authorization/RequestPermissionService.cs +++ b/src/Web/Grand.Web.Common/Security/Authorization/RequestPermissionService.cs @@ -1,28 +1,20 @@ -using Grand.Business.Common.Services.Security; -using Grand.Business.Core.Interfaces.Common.Directory; -using Grand.Data; +using Grand.Business.Core.Interfaces.Common.Security; using Grand.Domain.Permissions; using Grand.Infrastructure; -using Grand.Infrastructure.Caching; namespace Grand.Web.Common.Security.Authorization; public class RequestPermissionService( - IRepository permissionRepository, - IRepository permissionActionRepository, - IGroupService groupService, - ICacheBase cacheBase, - IContextAccessor contextAccessor) - : PermissionService(permissionRepository, permissionActionRepository, groupService, cacheBase), - IRequestPermissionService + IPermissionService permissionService, + IContextAccessor contextAccessor) : IRequestPermissionService { public Task Authorize(Permission permission) { - return Authorize(permission, contextAccessor.WorkContext?.CurrentCustomer); + return permissionService.Authorize(permission, contextAccessor.WorkContext?.CurrentCustomer); } public Task Authorize(string permissionSystemName) { - return Authorize(permissionSystemName, contextAccessor.WorkContext?.CurrentCustomer); + return permissionService.Authorize(permissionSystemName, contextAccessor.WorkContext?.CurrentCustomer); } } diff --git a/src/Web/Grand.Web/Controllers/KnowledgebaseController.cs b/src/Web/Grand.Web/Controllers/KnowledgebaseController.cs index 6fe7bb133b..6a6a273816 100644 --- a/src/Web/Grand.Web/Controllers/KnowledgebaseController.cs +++ b/src/Web/Grand.Web/Controllers/KnowledgebaseController.cs @@ -113,9 +113,8 @@ await _permissionService.Authorize(StandardPermission.ManageKnowledgebase)) })); //display "edit" (manage) link - var customer = _contextAccessor.WorkContext.CurrentCustomer; - if (await _permissionService.Authorize(StandardPermission.ManageAccessAdminPanel, customer) && - await _permissionService.Authorize(StandardPermission.ManageKnowledgebase, customer)) + if (await _permissionService.Authorize(StandardPermission.ManageAccessAdminPanel) && + await _permissionService.Authorize(StandardPermission.ManageKnowledgebase)) DisplayEditLink(Url.Action("EditCategory", "Knowledgebase", new { id = categoryId, area = "Admin" })); model.CurrentCategoryId = categoryId; @@ -217,8 +216,8 @@ await _permissionService.Authorize(StandardPermission.ManageKnowledgebase))) return NotFound(); //display "edit" (manage) link - if (await _permissionService.Authorize(StandardPermission.ManageAccessAdminPanel, customer) && - await _permissionService.Authorize(StandardPermission.ManageKnowledgebase, customer)) + if (await _permissionService.Authorize(StandardPermission.ManageAccessAdminPanel) && + await _permissionService.Authorize(StandardPermission.ManageKnowledgebase)) DisplayEditLink(Url.Action("EditArticle", "Knowledgebase", new { id = article.Id, area = "Admin" })); var model = new KnowledgebaseArticleModel(); From f1b8461ab42dde5f1bebbbdedaa2991e841df9bb Mon Sep 17 00:00:00 2001 From: support Date: Sun, 18 Oct 2026 12:11:05 +0200 Subject: [PATCH 3/3] Authorize the admin panel with the resolved customer in PermissionAuthorizeAction --- .ai/knowledge/security.md | 4 ++-- .../Authorization/PermissionAuthorizeActionAttribute.cs | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.ai/knowledge/security.md b/.ai/knowledge/security.md index 42694d94fd..dd3a8ebde2 100644 --- a/.ai/knowledge/security.md +++ b/.ai/knowledge/security.md @@ -10,12 +10,12 @@ Patterns from `Grand.Web`, `Grand.Module.Api`, `Grand.Business.*`. Complementary Every API and admin controller action must enforce permissions (either via `[PermissionAuthorize]` / `[PermissionAuthorizeAction]` attributes or explicit `Authorize` checks) before returning any data or performing any mutation. -`IPermissionService` (Business) only authorizes a customer you pass in. Code in Web, the admin panels and plugins injects `IRequestPermissionService` (`Grand.Web.Common.Security.Authorization`), which adds `Authorize(permission)` for the customer of the current request. `Grand.Module.Api` has no Web.Common reference, so its controllers pass `_contextAccessor.WorkContext.CurrentCustomer`. Code in `src/Business` never authorizes "the current customer". +`IPermissionService` (Business) only authorizes a customer you pass in. Code in Web, the admin panels and plugins injects `IRequestPermissionService` (`Grand.Web.Common.Security.Authorization`), which provides `Authorize(permission)` for the customer of the current request. `Grand.Module.Api` has no Web.Common reference, so its controllers keep `IPermissionService` and pass `CurrentCustomer` from `BaseApiController`. Code in `src/Business` never authorizes "the current customer". ```csharp public async Task Get() { - if (!await _permissionService.Authorize(PermissionSystemName.Brands, _contextAccessor.WorkContext.CurrentCustomer)) + if (!await _permissionService.Authorize(PermissionSystemName.Brands, CurrentCustomer)) return Forbid(); return Ok(await _mediator.Send(new GetGenericQuery())); diff --git a/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs b/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs index 48d6428e4c..67d981df8c 100644 --- a/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs +++ b/src/Web/Grand.Web.Common/Security/Authorization/PermissionAuthorizeActionAttribute.cs @@ -36,7 +36,6 @@ public async Task OnAuthorizationAsync(AuthorizationFilterContext context) return; var permissionService = context.HttpContext.RequestServices.GetRequiredService(); - var requestPermissionService = context.HttpContext.RequestServices.GetRequiredService(); var contextAccessor = context.HttpContext.RequestServices.GetRequiredService(); //check whether current customer has access to a public store @@ -46,7 +45,7 @@ await permissionService.AuthorizeAction(permissionAuthorize.Permission, Permissi return; //authorize permission of access to the admin area - if (!await requestPermissionService.Authorize(StandardPermission.ManageAccessAdminPanel)) + if (!await permissionService.Authorize(StandardPermission.ManageAccessAdminPanel, customer)) { context.Result = new RedirectToRouteResult("AdminLogin", new RouteValueDictionary()); }