ABP Web Api : [Authorize] attribute not working correctly with three permissions on Controller action

Abdelrahman Zidan 0
Viewed 39

ABP Web Api : [Authorize] attribute not working correctly with three permissions on action , only working correctly with one permission on action , as below :

User must have the three permissions until he can access Controller Action , but if user have only one permission he can not access Controller Action

I need method to allow any user that have only one permission to access Controller Action

[Authorize]
public class RequestDeleteBuildingController : AqaratController, IRequestDeleteBuildingAppService
{

    // 1'st method - not working
    //[Authorize(Roles = AqaratPermissions.RequestAddBuilding.Create + "," + AqaratPermissions.RequestEditBuilding.Create + "," + AqaratPermissions.RequestDeleteBuilding.Create)]

    // 2'nd method - not working
    //[Authorize(Roles = $"{AqaratPermissions.RequestAddBuilding.Create},{AqaratPermissions.RequestEditBuilding.Create},{AqaratPermissions.RequestDeleteBuilding.Create}")]

    // 3'rd method - not working
    //[Authorize(AqaratPermissions.RequestAddBuilding.Create)]
    //[Authorize(AqaratPermissions.RequestEditBuilding.Create)]
    //[Authorize(AqaratPermissions.RequestDeleteBuilding.Create)]

    // 4'th method - working only with one permission 
    [Authorize(AqaratPermissions.RequestAddBuilding.Create)]
    public async Task<RequestBuildingCoordinateDto> CreateAsync(Guid requestId, CreateUpdateRequestBuildingCoordinateDto input)
    {
        return await requestBuildingCoordinateAppService.CreateAsync(requestId, input);
    }

}
abp api
1 Answers

After searching we found two solutions tested and confirmed :

First solution : configure new custom policy for required permissions & use the policy in in [Authorize] above controller action, as in GitHub topic : https://github.com/abpframework/abp/pull/10152#issue-1007619207

// Configure custom policy for required permissions
        context.Services.AddAuthorization(options =>
        {
            options.AddPolicy("RequestAddBuilding.Edit_OR_RequestEditBuilding.Edit", policy =>
            {
                policy.Requirements.Add(new PermissionsRequirement(
                        new[] { AqaratPermissions.RequestAddBuilding.Edit, AqaratPermissions.RequestEditBuilding.Edit },
                        requiresAll: false));
            });
        });

// Use custom policy    
[Authorize("RequestAddBuilding.Edit_OR_RequestEditBuilding.Edit")]

Second solution : Check for required permissions with ABP IPermissionChecker permissionChecker.IsGrantedAsync() like this :

// Inject IPermissionChecker in controller 
private readonly IPermissionChecker permissionChecker;

//Check for Required Permissions
[HttpPut("{id}")]
public async Task<RequestBuildingMainDataDto> UpdateAsync(Guid id, CreateUpdateRequestBuildingMainDataDto input)
        {
            if (!(await permissionChecker.IsGrantedAsync(AqaratPermissions.RequestAddBuilding.Edit)) &&
                !(await permissionChecker.IsGrantedAsync(AqaratPermissions.RequestEditBuilding.Edit)))
                    throw new AbpAuthorizationException();

            return await requestBuildingMainDataAppService.UpdateAsync(id, input);
        }
Abdelrahman Zidan0
Related