Session persistent Security Profile
This commit is contained in:
Andy Howard
@@ -9,19 +9,24 @@ using Sarand.Net.Standard.Base.Security;
|
||||
using Sarand.Net.Standard.Base.Utils;
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using static Sarand.BusinessMgr.Net.Standard.Base.App.Sbm;
|
||||
|
||||
namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
{
|
||||
//=======================================================================
|
||||
public class SbmSecurityProfile : SaErrorStateItem, ISbmSecurityProfile_Core
|
||||
/// <summary>
|
||||
/// Security Profile associated with Core BusinessMgr Session.
|
||||
/// <para>Once populated from database (Security tables etc) data needs to be self-sustaining via Serialisation.deserialistion
|
||||
/// to ensure that no further database queries are required to reconsuct the data for each web request.</para>
|
||||
/// <para>Hence the local data structures to store the defined Security Rights and User/Host profiles.</para>
|
||||
/// </summary>
|
||||
public class SbmSecurityProfile : ISbmSecurityProfile_Core
|
||||
{
|
||||
//-------------------------------------------------------------------
|
||||
// Data members.
|
||||
private static readonly String userNameUnknown = "Unknown";
|
||||
private bool includeHostSecurityProfile = false;
|
||||
private SaSecurityProfile userSecurityProfile;
|
||||
private SaSecurityProfile hostSecurityProfile;
|
||||
private readonly List<SaSecurityRight> securityRights = new List<SaSecurityRight>();
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
// Construction.
|
||||
@@ -40,15 +45,18 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
//-------------------------------------------------------------------
|
||||
// Properties.
|
||||
|
||||
// User.
|
||||
public SysId UserId { get; protected set; } = new SysId();
|
||||
public String UserDisplayName { get; private set; }
|
||||
public String UserLocation { get; private set; }
|
||||
public DateTime UserLastLogin { get; private set; }
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
// Refresh profile.
|
||||
public void RefreshProfile(SbmSessionConsole sessionConsole, SaSecurityConsole securityConsole, SysId userId, List<SaSecurityRight> securityRights)
|
||||
{
|
||||
ClearErrorState();
|
||||
|
||||
// Make a note of the security right.
|
||||
this.securityRights.Clear();
|
||||
this.securityRights.AddRange(securityRights);
|
||||
PopulateSecurityRights(securityRights);
|
||||
|
||||
SysId previousUserId = UserId;
|
||||
|
||||
@@ -58,19 +66,19 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
// Load new profile.
|
||||
if (securityConsole != null)
|
||||
{
|
||||
userSecurityProfile = securityConsole.GetUserSecurityProfile(UserId);
|
||||
if (hostSecurityProfile == null && includeHostSecurityProfile)
|
||||
hostSecurityProfile = securityConsole.GetHostSecurityProfile();
|
||||
RefreshProfile(sessionConsole, securityConsole.GetUserSecurityProfile(UserId), includeHostSecurityProfile ? securityConsole.GetHostSecurityProfile() : null);
|
||||
}
|
||||
SaLogger.Debug($"{SysUtil.Fn} User: '{UserDisplayName}' [Id: {UserId}]" + (SysId.IsValid(previousUserId) ? ". Previous UserId: " + SysId.ToString(previousUserId) : ""));
|
||||
|
||||
RefreshProfileSettings(sessionConsole);
|
||||
|
||||
}
|
||||
protected void RefreshProfile(SbmSessionConsole sessionConsole, SaSecurityProfile userSecurityProfile, SaSecurityProfile hostSecurityProfile)
|
||||
{
|
||||
this.userSecurityProfile = userSecurityProfile;
|
||||
this.hostSecurityProfile = hostSecurityProfile;
|
||||
UserDisplayName = (userSecurityProfile?.Description ?? userNameUnknown);
|
||||
UserLocation = StringUtil.NullOnBlank(userSecurityProfile?.Location ?? "");
|
||||
UserLastLogin = (userSecurityProfile?.LastLogin ?? DateTime.MinValue);
|
||||
UserProfile.Populate(userSecurityProfile);
|
||||
if (hostSecurityProfile != null)
|
||||
HostProfile = new SecurityProfileData(hostSecurityProfile);
|
||||
RefreshProfileSettings(sessionConsole);
|
||||
}
|
||||
private void RefreshProfileSettings(SbmSessionConsole sessionConsole)
|
||||
@@ -94,30 +102,143 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
}
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
// User.
|
||||
public SysId UserId { get; protected set; } = new SysId();
|
||||
public String UserDisplayName { get { return (userSecurityProfile != null ? userSecurityProfile.Description : userNameUnknown); } }
|
||||
public String UserLocation { get { return (userSecurityProfile != null ? userSecurityProfile.Location : ""); } }
|
||||
public DateTime UserLastLogin { get { return (userSecurityProfile != null ? userSecurityProfile.LastLogin : DateTime.MinValue); } }
|
||||
// Security Rights.
|
||||
public class SecurityRightData
|
||||
{
|
||||
public int Type { get; set; }
|
||||
public String Code { get; set; }
|
||||
}
|
||||
[JsonProperty("SecurityRights")]
|
||||
public List<SecurityRightData> SecurityRights { get; private set; } = new List<SecurityRightData>();
|
||||
private void PopulateSecurityRights(List<SaSecurityRight> rights)
|
||||
{
|
||||
SecurityRights = rights.Select(item => new SecurityRightData() { Type = item.Type, Code = item.Code }).ToList();
|
||||
}
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
// Security Profiles.
|
||||
// Profile properties are stored locally in such a way to allow serialisation/deserialisation
|
||||
// and application of security rules without having to duplicate the complete Security Profile.
|
||||
|
||||
public class SecurityProfileData
|
||||
{
|
||||
public SecurityProfileData() { }
|
||||
public SecurityProfileData(SaSecurityProfile securityProfile)
|
||||
{
|
||||
Populate(securityProfile);
|
||||
}
|
||||
// Security.
|
||||
/// <summary>Is the Security Right code granted access for the Data item (if specified).</summary>
|
||||
public bool IsSecurityRightGranted(String rightCode, SysId dataItemId = null)
|
||||
{
|
||||
if (SystemAdmin ?? false) return true;
|
||||
return ((Groups != null && Groups.Any(item => item.Rights.IsSecurityRightGranted(rightCode, dataItemId))) || (Rights != null && Rights.IsSecurityRightGranted(rightCode, dataItemId)));
|
||||
}
|
||||
/// <summary>Is the Security Right code denined access for the Data item (if specified).</summary>
|
||||
public bool IsSecurityRightDenied(String rightCode, SysId dataItemId = null)
|
||||
{
|
||||
if (SystemAdmin ?? false) return false;
|
||||
return ((Groups != null && Groups.Any(item => item.Rights.IsSecurityRightDenied(rightCode, dataItemId))) || (Rights != null && Rights.IsSecurityRightDenied(rightCode, dataItemId)));
|
||||
}
|
||||
// Population.
|
||||
public void Populate(SaSecurityProfile securityProfile)
|
||||
{
|
||||
Clear();
|
||||
if (securityProfile.SystemAdmin)
|
||||
SystemAdmin = true;
|
||||
foreach (var group in securityProfile.Groups)
|
||||
{
|
||||
GroupData groupData = new GroupData() { Code = group.Code };
|
||||
groupData.Rights.Populate(group.Rights);
|
||||
Groups.Add(groupData);
|
||||
}
|
||||
Rights.Populate(securityProfile.Rights);
|
||||
}
|
||||
public void Clear()
|
||||
{
|
||||
SystemAdmin = null;
|
||||
Groups.Clear();
|
||||
Rights.Clear();
|
||||
}
|
||||
// Properties.
|
||||
public bool? SystemAdmin { get; private set; }
|
||||
public class GroupData
|
||||
{
|
||||
public String Code { get; set; }
|
||||
public RightsData Rights { get; set; } = new RightsData();
|
||||
}
|
||||
public List<GroupData> Groups { get; private set; } = new List<GroupData>();
|
||||
public class RightData
|
||||
{
|
||||
public String Code { get; set; }
|
||||
public SysId DataItemId { get; set; }
|
||||
}
|
||||
public class RightsData
|
||||
{
|
||||
// Construction.
|
||||
public RightsData() { }
|
||||
public RightsData(IEnumerable<SaSecurityProfile.RightData> rights)
|
||||
{
|
||||
Populate(rights);
|
||||
}
|
||||
// Security.
|
||||
public bool IsSecurityRightGranted(String rightCode, SysId dataItemId)
|
||||
{
|
||||
return Granted != null && Granted.Any(item => item.Code.EqualsCI(rightCode) && SysId.ToInt(dataItemId) == SysId.ToInt(item.DataItemId));
|
||||
}
|
||||
public bool IsSecurityRightDenied(String rightCode, SysId dataItemId)
|
||||
{
|
||||
return Denied != null && Denied.Any(item => item.Code.EqualsCI(rightCode) && SysId.ToInt(dataItemId) == SysId.ToInt(item.DataItemId));
|
||||
}
|
||||
// Population.
|
||||
public void Populate(IEnumerable<SaSecurityProfile.RightData> rights)
|
||||
{
|
||||
Clear();
|
||||
foreach (var right in rights)
|
||||
{
|
||||
RightData rightData = new RightData() { Code = right.Code, DataItemId = SysId.IsValid(right.DataItemId) ? right.DataItemId : null };
|
||||
if (right.Granted)
|
||||
{
|
||||
if (Granted == null) Granted = new HashSet<RightData>();
|
||||
Granted.Add(rightData);
|
||||
}
|
||||
else
|
||||
{
|
||||
if (Denied == null) Denied = new HashSet<RightData>();
|
||||
Denied.Add(rightData);
|
||||
}
|
||||
}
|
||||
}
|
||||
public void Clear()
|
||||
{
|
||||
Granted = null;
|
||||
Denied = null;
|
||||
}
|
||||
public HashSet<RightData> Granted { get; private set; }
|
||||
public HashSet<RightData> Denied { get; private set; }
|
||||
}
|
||||
public RightsData Rights { get; private set; } = new RightsData();
|
||||
}
|
||||
// User and Host profiles.
|
||||
public SecurityProfileData UserProfile { get; private set; } = new SecurityProfileData();
|
||||
public SecurityProfileData HostProfile { get; private set; }
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
// Utilities.
|
||||
public bool IsUserMemberOfSecurityGroup(SysId secGroupId)
|
||||
public String GetSecurityRightCode(Sbm.SecurityRight securityRight)
|
||||
{
|
||||
if (userSecurityProfile != null)
|
||||
return userSecurityProfile.IsMemberOfSecurityGroup(secGroupId);
|
||||
return false;
|
||||
return SecurityRights.FirstOrDefault(item => item.Type == (int)securityRight)?.Code ?? "";
|
||||
}
|
||||
public bool IsSecurityRightGranted(Sbm.SecurityRight securityRight, SysId id = null)
|
||||
{
|
||||
if (userSecurityProfile != null)
|
||||
return userSecurityProfile.IsSecurityRightGranted(securityRights.GetCodeForType(securityRight));
|
||||
if (UserProfile != null)
|
||||
return UserProfile.IsSecurityRightGranted(GetSecurityRightCode(securityRight), id);
|
||||
return false;
|
||||
}
|
||||
public bool IsSecurityRightDenied(Sbm.SecurityRight securityRight, SysId id = null)
|
||||
{
|
||||
if (userSecurityProfile != null)
|
||||
return userSecurityProfile.IsSecurityRightDenied(securityRights.GetCodeForType(securityRight), id);
|
||||
if (UserProfile != null)
|
||||
return UserProfile.IsSecurityRightDenied(GetSecurityRightCode(securityRight), id);
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -126,59 +247,80 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
public class AdminProfile
|
||||
{
|
||||
internal AdminProfile() { }
|
||||
public bool CanManageSecurity { get; internal set; } = false;
|
||||
public bool CanManageDatabase { get; internal set; } = false;
|
||||
public bool CanManageReferenceData { get; internal set; } = false;
|
||||
public bool CanManageInterfaces { get; internal set; } = false;
|
||||
public bool? ManageSecurity { get; internal set; }
|
||||
public bool? ManageDatabase { get; internal set; }
|
||||
public bool? ManageReferenceData { get; internal set; }
|
||||
public bool? ManageInterfaces { get; internal set; }
|
||||
}
|
||||
public AdminProfile Admin { get; internal set; }
|
||||
private void RefreshAdminProfile(SbmSessionConsole sessionConsole)
|
||||
{
|
||||
Admin.CanManageSecurity = UserHasSecurityRight(Sbm.SecurityRight.Security_Admin);
|
||||
Admin.CanManageDatabase = UserHasSecurityRight(Sbm.SecurityRight.Database_Admin);
|
||||
Admin.CanManageReferenceData = UserHasSecurityRight(Sbm.SecurityRight.ReferenceData_Admin);
|
||||
Admin.CanManageInterfaces = UserHasSecurityRight(Sbm.SecurityRight.InterfaceConfig);
|
||||
if (UserHasSecurityRight(Sbm.SecurityRight.Security_Admin))
|
||||
Admin.ManageSecurity = true;
|
||||
if (UserHasSecurityRight(Sbm.SecurityRight.Database_Admin))
|
||||
Admin.ManageDatabase = true;
|
||||
if (UserHasSecurityRight(Sbm.SecurityRight.ReferenceData_Admin))
|
||||
Admin.ManageReferenceData = true;
|
||||
if (UserHasSecurityRight(Sbm.SecurityRight.InterfaceConfig))
|
||||
Admin.ManageInterfaces = true;
|
||||
}
|
||||
// Admin.
|
||||
public bool UserCanManageSecurity() { return Admin.ManageSecurity ?? false; }
|
||||
public bool UserCanManageDatabase() { return Admin.ManageDatabase ?? false; }
|
||||
public bool UserCanManageReferenceData() { return Admin.ManageReferenceData ?? false; }
|
||||
public bool UserCanManageInterfaces() { return Admin.ManageInterfaces ?? false; }
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
// Security rights - Manage.
|
||||
public class ManageProfile
|
||||
{
|
||||
internal ManageProfile() { }
|
||||
public bool CanManageTasks { get; internal set; } = false;
|
||||
public bool CanManageTimesheets { get; internal set; } = false;
|
||||
public bool? CanManageTasks { get; internal set; }
|
||||
public bool? CanManageTimesheets { get; internal set; }
|
||||
}
|
||||
public ManageProfile Manage { get; internal set; }
|
||||
private void RefreshManageProfile(SbmSessionConsole sessionConsole)
|
||||
{
|
||||
Manage.CanManageTasks = UserHasSecurityRight(Sbm.SecurityRight.TaskManager);
|
||||
Manage.CanManageTimesheets = UserHasSecurityRight(Sbm.SecurityRight.TimesheetManager);
|
||||
if (UserHasSecurityRight(Sbm.SecurityRight.TaskManager))
|
||||
Manage.CanManageTasks = true;
|
||||
if (UserHasSecurityRight(Sbm.SecurityRight.TimesheetManager))
|
||||
Manage.CanManageTimesheets = true;
|
||||
}
|
||||
// Manage.
|
||||
public bool UserCanManageTasks() { return Manage.CanManageTasks ?? false; }
|
||||
public bool UserCanManageTimesheets() { return Manage.CanManageTimesheets ?? false; }
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
// Security rights - Financials.
|
||||
public class FinancialProfile
|
||||
{
|
||||
internal FinancialProfile() { }
|
||||
public bool ViewFinancials { get; internal set; }
|
||||
public bool UpdateFinancials { get; internal set; }
|
||||
public bool ViewCommoditySupplyFinancials { get; internal set; }
|
||||
public bool UpdateCommoditySupplyFinancials { get; internal set; }
|
||||
public bool ViewCommoditySalesFinancials { get; internal set; }
|
||||
public bool UpdateCommoditySalesFinancials { get; internal set; }
|
||||
public bool FinancialsAccessControl { get; internal set; }
|
||||
public bool? ViewFinancials { get; internal set; }
|
||||
public bool? UpdateFinancials { get; internal set; }
|
||||
public bool? ViewCommoditySupplyFinancials { get; internal set; }
|
||||
public bool? UpdateCommoditySupplyFinancials { get; internal set; }
|
||||
public bool? ViewCommoditySalesFinancials { get; internal set; }
|
||||
public bool? UpdateCommoditySalesFinancials { get; internal set; }
|
||||
public bool? FinancialsAccessControl { get; internal set; }
|
||||
}
|
||||
public FinancialProfile Financial { get; internal set; }
|
||||
private void RefreshFinancialProfile(SbmSessionConsole sessionConsole)
|
||||
{
|
||||
Financial.ViewFinancials = UserHasSecurityRight(Sbm.SecurityRight.Financial_View);
|
||||
Financial.UpdateFinancials = UserHasSecurityRight(Sbm.SecurityRight.Financial_Update);
|
||||
Financial.ViewCommoditySupplyFinancials = UserCanAccessFinancialViewOfType(Sbm.FinancialType.CommoditySupply);
|
||||
Financial.UpdateCommoditySupplyFinancials = UserCanAccessFinancialUpdateOfType(Sbm.FinancialType.CommoditySupply);
|
||||
Financial.ViewCommoditySalesFinancials = UserCanAccessFinancialViewOfType(Sbm.FinancialType.CommoditySales);
|
||||
Financial.UpdateCommoditySalesFinancials = UserCanAccessFinancialUpdateOfType(Sbm.FinancialType.CommoditySales);
|
||||
if (UserHasSecurityRight(Sbm.SecurityRight.Financial_View))
|
||||
Financial.ViewFinancials = true;
|
||||
if (UserHasSecurityRight(Sbm.SecurityRight.Financial_Update))
|
||||
Financial.UpdateFinancials = true;
|
||||
if (UserCanAccessFinancialViewOfType(Sbm.FinancialType.CommoditySupply))
|
||||
Financial.ViewCommoditySupplyFinancials = true;
|
||||
if (UserCanAccessFinancialUpdateOfType(Sbm.FinancialType.CommoditySupply))
|
||||
Financial.UpdateCommoditySupplyFinancials = true;
|
||||
if (UserCanAccessFinancialViewOfType(Sbm.FinancialType.CommoditySales))
|
||||
Financial.ViewCommoditySalesFinancials = true;
|
||||
if (UserCanAccessFinancialUpdateOfType(Sbm.FinancialType.CommoditySales))
|
||||
Financial.UpdateCommoditySalesFinancials = true;
|
||||
// Config options.
|
||||
Financial.FinancialsAccessControl = (sessionConsole != null && !sessionConsole.AllowOption(Sbm.ConfigOption.FinancialsAccessControl));
|
||||
if ((sessionConsole != null && !sessionConsole.AllowOption(Sbm.ConfigOption.FinancialsAccessControl)))
|
||||
Financial.FinancialsAccessControl = true;
|
||||
}
|
||||
|
||||
private bool UserCanAccessFinancialViewOfType(Sbm.FinancialType financialType)
|
||||
@@ -202,14 +344,14 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
/// <summary>Does the user have sufficient rights to view the specified financials.</summary>
|
||||
public bool UserCanViewFinancials(Sbm.FinancialType financialType = Sbm.FinancialType.Any)
|
||||
{
|
||||
if (!Financial.FinancialsAccessControl) return true;
|
||||
if (Financial.UpdateFinancials || Financial.ViewFinancials)
|
||||
if (!Financial.FinancialsAccessControl ?? false) return true;
|
||||
if ((Financial.UpdateFinancials ?? false) || (Financial.ViewFinancials ?? false))
|
||||
{
|
||||
// If specific type of financial is requested, check that view access is not denied.
|
||||
if (financialType == Sbm.FinancialType.CommoditySupply)
|
||||
return Financial.ViewCommoditySupplyFinancials;
|
||||
return Financial.ViewCommoditySupplyFinancials ?? false;
|
||||
else if (financialType == Sbm.FinancialType.CommoditySales)
|
||||
return Financial.ViewCommoditySalesFinancials;
|
||||
return Financial.ViewCommoditySalesFinancials ?? false;
|
||||
else return true;
|
||||
}
|
||||
return false;
|
||||
@@ -218,14 +360,14 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
/// <summary>Does the user have sufficient rights to update the specified financials.</summary>
|
||||
public bool UserCanUpdateFinancials(Sbm.FinancialType financialType = Sbm.FinancialType.Any)
|
||||
{
|
||||
if (!Financial.FinancialsAccessControl) return true;
|
||||
if (Financial.UpdateFinancials)
|
||||
if (!Financial.FinancialsAccessControl ?? false) return true;
|
||||
if (Financial.UpdateFinancials ?? false)
|
||||
{
|
||||
// If specific type of financial is requested, check that update access is not denied.
|
||||
if (financialType == Sbm.FinancialType.CommoditySupply)
|
||||
return Financial.UpdateCommoditySupplyFinancials;
|
||||
return Financial.UpdateCommoditySupplyFinancials ?? false;
|
||||
else if (financialType == Sbm.FinancialType.CommoditySales)
|
||||
return Financial.UpdateCommoditySalesFinancials;
|
||||
return Financial.UpdateCommoditySalesFinancials ?? false;
|
||||
else return true;
|
||||
}
|
||||
return false;
|
||||
@@ -236,58 +378,38 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
public class ContactsProfile
|
||||
{
|
||||
internal ContactsProfile() { }
|
||||
public bool Create { get; internal set; } = false;
|
||||
public bool Update { get; internal set; } = false;
|
||||
public bool? Create { get; internal set; }
|
||||
public bool? Update { get; internal set; }
|
||||
}
|
||||
public ContactsProfile Contacts { get; internal set; }
|
||||
public bool UserCanCreateContacts() { return Contacts.Create; }
|
||||
public bool UserCanUpdateContacts() { return Contacts.Update; }
|
||||
private void RefreshContactsProfile(SbmSessionConsole sessionConsole)
|
||||
{
|
||||
Contacts.Update = (UserHasSecurityRight(Sbm.SecurityRight.Affiliate_Update));
|
||||
Contacts.Create = (Contacts.Update || UserHasSecurityRight(Sbm.SecurityRight.Affiliate_Create));
|
||||
if (UserHasSecurityRight(Sbm.SecurityRight.Affiliate_Update))
|
||||
Contacts.Update = true;
|
||||
if (Contacts.Update ?? false || UserHasSecurityRight(Sbm.SecurityRight.Affiliate_Create))
|
||||
Contacts.Create = true;
|
||||
}
|
||||
// Contacts.
|
||||
public bool UserCanCreateContacts() { return Contacts.Create ?? false; }
|
||||
public bool UserCanUpdateContacts() { return Contacts.Update ?? false; }
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
// Security rights - Transactions.
|
||||
public class TransactionsProfile
|
||||
{
|
||||
internal TransactionsProfile() { }
|
||||
public bool Create { get; internal set; } = false;
|
||||
public bool Update { get; internal set; } = false;
|
||||
public bool CanUpdateTransactionTypeStatusCat(SbmSecurityProfile securityProfile, Sbm.TransactionType transactionType, SbmTransaction.StatusCat transactionStatusCat)
|
||||
{
|
||||
SysId transactionTypeStatusCatId = SbmTransaction.GetTransactionTypeStatusId(transactionType, transactionStatusCat);
|
||||
|
||||
// Check if update of this transaction type and status is denied:
|
||||
if (securityProfile.IsSecurityRightDenied(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, transactionTypeStatusCatId))
|
||||
return false;
|
||||
|
||||
// Check if update of this transaction type and status is explicitly allowed:
|
||||
if (securityProfile.IsSecurityRightGranted(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, transactionTypeStatusCatId))
|
||||
return true;
|
||||
|
||||
// Check if any other statuses for this type of transaction are allowed.
|
||||
foreach (TypeCodeDesc statusCat in SbmTransaction.GetTransactionStatusCats(transactionType))
|
||||
{
|
||||
SbmTransaction.StatusCat transactionStatusCatOther = (SbmTransaction.StatusCat)statusCat.Type;
|
||||
// Ignore the transaction status category.
|
||||
if (transactionStatusCatOther == transactionStatusCat) continue;
|
||||
if (securityProfile.IsSecurityRightGranted(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, SbmTransaction.GetTransactionTypeStatusId(transactionType, transactionStatusCatOther)))
|
||||
// Explicit granting of right to another status for this transaction right
|
||||
// implies that other statuses are implicitly denied.
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
public bool? Create { get; internal set; }
|
||||
public bool? Update { get; internal set; }
|
||||
}
|
||||
public TransactionsProfile Transaction { get; internal set; }
|
||||
private void RefreshTransactionProfile(SbmSessionConsole sessionConsole)
|
||||
{
|
||||
Transaction.Update = (UserHasSecurityRight(Sbm.SecurityRight.Transaction_Update));
|
||||
Transaction.Create = (Transaction.Update || UserHasSecurityRight(Sbm.SecurityRight.Transaction_View));
|
||||
if ((UserHasSecurityRight(Sbm.SecurityRight.Transaction_Update)))
|
||||
Transaction.Update = true;
|
||||
if ((Transaction.Update ?? false || UserHasSecurityRight(Sbm.SecurityRight.Transaction_View)))
|
||||
Transaction.Create = true;
|
||||
}
|
||||
|
||||
// Transactions.
|
||||
public bool UserCanAccessTransactionsOfType(Sbm.TransactionType transactionType)
|
||||
{
|
||||
if ((int)transactionType < 1) return false;
|
||||
@@ -296,29 +418,54 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
return false;
|
||||
return true;
|
||||
}
|
||||
public bool CanUpdateTransactionTypeStatusCat(Sbm.TransactionType transactionType, SbmTransaction.StatusCat transactionStatusCat)
|
||||
{
|
||||
SysId transactionTypeStatusCatId = SbmTransaction.GetTransactionTypeStatusId(transactionType, transactionStatusCat);
|
||||
|
||||
// Check if update of this transaction type and status is denied:
|
||||
if (IsSecurityRightDenied(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, transactionTypeStatusCatId))
|
||||
return false;
|
||||
|
||||
// Check if update of this transaction type and status is explicitly allowed:
|
||||
if (IsSecurityRightGranted(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, transactionTypeStatusCatId))
|
||||
return true;
|
||||
|
||||
// Check if any other statuses for this type of transaction are allowed.
|
||||
foreach (TypeCodeDesc statusCat in SbmTransaction.GetTransactionStatusCats(transactionType))
|
||||
{
|
||||
SbmTransaction.StatusCat transactionStatusCatOther = (SbmTransaction.StatusCat)statusCat.Type;
|
||||
// Ignore the transaction status category.
|
||||
if (transactionStatusCatOther == transactionStatusCat) continue;
|
||||
if (IsSecurityRightGranted(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, SbmTransaction.GetTransactionTypeStatusId(transactionType, transactionStatusCatOther)))
|
||||
// Explicit granting of right to another status for this transaction right
|
||||
// implies that other statuses are implicitly denied.
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
// Security rights - ItemType.
|
||||
public class ItemTypesProfile
|
||||
{
|
||||
internal ItemTypesProfile() { }
|
||||
public bool Create { get; internal set; }
|
||||
public bool Update { get; internal set; }
|
||||
public bool Remove { get; internal set; }
|
||||
public bool? Create { get; internal set; }
|
||||
public bool? Update { get; internal set; }
|
||||
public bool? Remove { get; internal set; }
|
||||
// Config options.
|
||||
public bool Processes { get; internal set; }
|
||||
public bool Contacts { get; internal set; }
|
||||
public bool Commodities { get; internal set; }
|
||||
public bool Portfolios { get; internal set; }
|
||||
public bool PriceSets { get; internal set; }
|
||||
public bool CommodityCustomers { get; internal set; }
|
||||
public bool CommoditySuppliers { get; internal set; }
|
||||
public bool Transactions { get; internal set; }
|
||||
public bool Assets { get; internal set; }
|
||||
public bool Vehicles { get; internal set; }
|
||||
public bool StockLocations { get; internal set; }
|
||||
public bool StockContainers { get; internal set; }
|
||||
public bool StockControl { get; internal set; }
|
||||
public bool? Processes { get; internal set; }
|
||||
public bool? Contacts { get; internal set; }
|
||||
public bool? Commodities { get; internal set; }
|
||||
public bool? Portfolios { get; internal set; }
|
||||
public bool? PriceSets { get; internal set; }
|
||||
public bool? CommodityCustomers { get; internal set; }
|
||||
public bool? CommoditySuppliers { get; internal set; }
|
||||
public bool? Transactions { get; internal set; }
|
||||
public bool? Assets { get; internal set; }
|
||||
public bool? Vehicles { get; internal set; }
|
||||
public bool? StockLocations { get; internal set; }
|
||||
public bool? StockContainers { get; internal set; }
|
||||
public bool? StockControl { get; internal set; }
|
||||
}
|
||||
public ItemTypesProfile ItemType { get; } = new ItemTypesProfile();
|
||||
private void RefreshItemTypeProfile(SbmSessionConsole sessionConsole)
|
||||
@@ -337,56 +484,14 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
ItemType.StockContainers = sessionConsole.GetStockControlConfig().AllowStockContainers();
|
||||
ItemType.StockControl = sessionConsole.GetStockControlConfig().AllowStockControl();
|
||||
}
|
||||
|
||||
public bool ItemTypeIsAllowed(Sbm.ItemType itemType)
|
||||
// Item types.
|
||||
public bool UserCanViewItemType(Sbm.ItemType itemType)
|
||||
{
|
||||
switch (itemType)
|
||||
{
|
||||
//case Sbm.ItemType.SecItem:
|
||||
//case Sbm.ItemType.Currency:
|
||||
//case Sbm.ItemType.Region:
|
||||
//case Sbm.ItemType.Language:
|
||||
//case Sbm.ItemType.TaxCode:
|
||||
//case Sbm.ItemType.UnitMeasure:
|
||||
case Sbm.ItemType.Process: return ItemType.Processes;
|
||||
case Sbm.ItemType.Affiliate:
|
||||
case Sbm.ItemType.Address: return ItemType.Contacts;
|
||||
case Sbm.ItemType.Commodity: return ItemType.Commodities;
|
||||
case Sbm.ItemType.PortfolioItem: return ItemType.Portfolios;
|
||||
case Sbm.ItemType.Location: return ItemType.StockLocations;
|
||||
case Sbm.ItemType.Container:
|
||||
case Sbm.ItemType.ContainerItem: return ItemType.StockContainers;
|
||||
case Sbm.ItemType.Movement:
|
||||
case Sbm.ItemType.StockLevel: return ItemType.StockControl;
|
||||
case Sbm.ItemType.PriceSet:
|
||||
case Sbm.ItemType.Price: return ItemType.PriceSets;
|
||||
case Sbm.ItemType.CommodityCustomer: return ItemType.CommodityCustomers;
|
||||
case Sbm.ItemType.CommoditySupplier: return ItemType.CommoditySuppliers;
|
||||
//case Sbm.ItemType.Association:
|
||||
case Sbm.ItemType.Transaction:
|
||||
case Sbm.ItemType.Requirement:
|
||||
case Sbm.ItemType.Constituent: return ItemType.Transactions;
|
||||
//case Sbm.ItemType.SystemAccount:
|
||||
//case Sbm.ItemType.SystemUser:
|
||||
//case Sbm.ItemType.SystemAccountUser:
|
||||
case Sbm.ItemType.AssetCategory:
|
||||
case Sbm.ItemType.AssetCategoryProcess:
|
||||
case Sbm.ItemType.Asset:
|
||||
case Sbm.ItemType.AssetProcess: return ItemType.Assets;
|
||||
case Sbm.ItemType.VehicleClass:
|
||||
case Sbm.ItemType.Vehicle:
|
||||
case Sbm.ItemType.VehicleEvent:
|
||||
case Sbm.ItemType.VehicleFeature: return ItemType.Vehicles;
|
||||
case Sbm.ItemType.CommodityProcess: return ItemType.Processes;
|
||||
case Sbm.ItemType.RequirementProcess: return ItemType.Processes;
|
||||
//case Sbm.ItemType.Interface:
|
||||
}
|
||||
return true;
|
||||
}
|
||||
public bool UserCanCreateItemType(Sbm.ItemType itemType)
|
||||
{
|
||||
if (userSecurityProfile?.SystemAdmin ?? false) return true;
|
||||
if (!ItemTypeIsAllowed(itemType)) return false;
|
||||
if (UserProfile?.SystemAdmin ?? false) return true;
|
||||
switch (itemType)
|
||||
{
|
||||
case Sbm.ItemType.SecItem: return IsSecurityRightGranted(Sbm.SecurityRight.Security_Admin);
|
||||
@@ -432,7 +537,7 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
}
|
||||
public bool UserCanUpdateItemType(Sbm.ItemType itemType)
|
||||
{
|
||||
if (userSecurityProfile?.SystemAdmin ?? false) return true;
|
||||
if (UserProfile?.SystemAdmin ?? false) return true;
|
||||
switch (itemType)
|
||||
{
|
||||
case Sbm.ItemType.SecItem: return IsSecurityRightGranted(Sbm.SecurityRight.Security_Admin);
|
||||
@@ -493,17 +598,75 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
||||
// Security rights.
|
||||
public bool UserHasSecurityRight(Sbm.SecurityRight securityRight, SysId dataItemId = null)
|
||||
{
|
||||
String rightCode = securityRights.GetCodeForType(securityRight);
|
||||
String rightCode = GetSecurityRightCode(securityRight);
|
||||
if (StringUtil.IsEmpty(rightCode)) return false;
|
||||
// Check if right is denied by either user or host profiles.
|
||||
if (userSecurityProfile != null && userSecurityProfile.IsSecurityRightDenied(rightCode)) return false;
|
||||
if (hostSecurityProfile != null && hostSecurityProfile.IsSecurityRightDenied(rightCode)) return false;
|
||||
if (UserProfile?.IsSecurityRightDenied(rightCode) ?? false) return false;
|
||||
if (HostProfile?.IsSecurityRightDenied(rightCode) ?? false) return false;
|
||||
// Check if right is granted by either user or host profiles.
|
||||
if (userSecurityProfile != null && userSecurityProfile.IsSecurityRightGranted(rightCode)) return true;
|
||||
if (hostSecurityProfile != null && hostSecurityProfile.IsSecurityRightGranted(rightCode)) return true;
|
||||
if (UserProfile?.IsSecurityRightGranted(rightCode) ?? false) return true;
|
||||
if (HostProfile?.IsSecurityRightGranted(rightCode) ?? false) return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
public class SecurityProfileException : Exception
|
||||
{
|
||||
public SecurityProfileException(string message) : base(message) { }
|
||||
}
|
||||
/// <summary>Verify that the specified profiles matches this one, eg. after deserialisation.</summary>
|
||||
public bool CompareProfiles(ISbmSecurityProfile_Core securityProfile_Core)
|
||||
{
|
||||
// Profile.
|
||||
if (securityProfile_Core == null)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile is null.");
|
||||
SbmSecurityProfile securityProfile = securityProfile_Core as SbmSecurityProfile;
|
||||
if (securityProfile == null)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile does not match type.");
|
||||
|
||||
// Security rights.
|
||||
if (SecurityRights.Count != securityProfile.SecurityRights.Count)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Security Rights. Expected: {SecurityRights.Count}. Found: {securityProfile.SecurityRights}.");
|
||||
|
||||
// User profile.
|
||||
if (UserProfile != null && securityProfile.UserProfile == null)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile is missing a User Profile.");
|
||||
if (UserProfile == null && securityProfile.UserProfile != null)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile includes a User Profile.");
|
||||
|
||||
// User profile - Groups.
|
||||
if (UserProfile.Groups?.Count != securityProfile.UserProfile.Groups?.Count)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of User Groups. Expected: {UserProfile.Groups?.Count}. Found: {securityProfile.UserProfile.Groups?.Count}.");
|
||||
|
||||
// User profile - Granted Rights.
|
||||
if (UserProfile.Rights?.Granted?.Count != securityProfile.UserProfile.Rights?.Granted?.Count)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Granted User Rights. Expected: {UserProfile.Rights?.Granted?.Count}. Found: {securityProfile.UserProfile.Rights?.Granted?.Count}.");
|
||||
|
||||
// User profile - Denied Rights.
|
||||
if (UserProfile.Rights?.Denied?.Count != securityProfile.UserProfile.Rights?.Denied?.Count)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Denied User Rights. Expected: {UserProfile.Rights?.Denied?.Count}. Found: {securityProfile.UserProfile.Rights?.Denied?.Count}.");
|
||||
|
||||
// Host profile.
|
||||
if (HostProfile != null && securityProfile.HostProfile == null)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile is missing a Host Profile.");
|
||||
if (HostProfile == null && securityProfile.HostProfile != null)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile includes a Host Profile.");
|
||||
|
||||
// Host profile - Groups.
|
||||
if (HostProfile?.Groups?.Count != securityProfile.HostProfile?.Groups?.Count)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Host Groups. Expected: {HostProfile?.Groups?.Count}. Found: {securityProfile.HostProfile?.Groups?.Count}.");
|
||||
|
||||
// Host profile - Granted Rights.
|
||||
if (HostProfile?.Rights?.Granted?.Count != securityProfile.HostProfile?.Rights?.Granted?.Count)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Granted Host Rights. Expected: {HostProfile?.Rights?.Granted?.Count}. Found: {securityProfile.HostProfile?.Rights?.Granted?.Count}.");
|
||||
|
||||
// Host profile - Denied Rights.
|
||||
if (HostProfile?.Rights?.Denied?.Count != securityProfile.HostProfile?.Rights?.Denied?.Count)
|
||||
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Denied Host Rights. Expected: {HostProfile?.Rights?.Denied?.Count}. Found: {securityProfile.HostProfile?.Rights?.Denied?.Count}.");
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
//-------------------------------------------------------------------
|
||||
}
|
||||
//=======================================================================
|
||||
|
||||
Reference in New Issue
Block a user