685 lines
31 KiB
C#
685 lines
31 KiB
C#
using Newtonsoft.Json;
|
|
using Sarand.BusinessMgr.Net.Standard.Base.Bus;
|
|
using Sarand.BusinessMgr.Net.Standard.Base.Consoles;
|
|
using Sarand.BusinessMgr.Net.Standard.Base.Core;
|
|
using Sarand.Net.Standard.Base.App;
|
|
using Sarand.Net.Standard.Base.Bus;
|
|
using Sarand.Net.Standard.Base.Core;
|
|
using Sarand.Net.Standard.Base.Security;
|
|
using Sarand.Net.Standard.Base.Utils;
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Linq;
|
|
|
|
namespace Sarand.BusinessMgr.Net.Standard.Base.App
|
|
{
|
|
//=======================================================================
|
|
/// <summary>
|
|
/// Security Profile associated with Core BusinessMgr Session.
|
|
/// <para>Once populated from database (Security tables etc) data needs to be self-sustaining via Serialisation.deserialistion
|
|
/// to ensure that no further database queries are required to reconsuct the data for each web request.</para>
|
|
/// <para>Hence the local data structures to store the defined Security Rights and User/Host profiles.</para>
|
|
/// </summary>
|
|
public class SbmSecurityProfile : ISbmSecurityProfile_Core
|
|
{
|
|
//-------------------------------------------------------------------
|
|
// Data members.
|
|
private static readonly String userNameUnknown = "Unknown";
|
|
private bool includeHostSecurityProfile = false;
|
|
|
|
//-------------------------------------------------------------------
|
|
// Construction.
|
|
[JsonConstructor]
|
|
private SbmSecurityProfile() { }
|
|
public SbmSecurityProfile(bool includeHostSecurityProfile)
|
|
{
|
|
this.includeHostSecurityProfile = includeHostSecurityProfile;
|
|
Admin = new AdminProfile();
|
|
Manage = new ManageProfile();
|
|
Financial = new FinancialProfile();
|
|
Contacts = new ContactsProfile();
|
|
Transaction = new TransactionsProfile();
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
// Properties.
|
|
|
|
// User.
|
|
public SysId UserId { get; protected set; } = new SysId();
|
|
public String UserDisplayName { get; private set; }
|
|
public String UserLocation { get; private set; }
|
|
public DateTime UserLastLogin { get; private set; }
|
|
|
|
//-------------------------------------------------------------------
|
|
// Refresh profile.
|
|
public void RefreshProfile(SbmSessionConsole sessionConsole, SaSecurityConsole securityConsole, SysId userId, List<SaSecurityRight> securityRights)
|
|
{
|
|
// Make a note of the security right.
|
|
PopulateSecurityRights(securityRights);
|
|
|
|
SysId previousUserId = UserId;
|
|
|
|
// Clear existing profile.
|
|
UserId = SysId.InvalidOnNull(userId);
|
|
|
|
// Load new profile.
|
|
if (securityConsole != null)
|
|
{
|
|
RefreshProfile(sessionConsole, securityConsole.GetUserSecurityProfile(UserId), includeHostSecurityProfile ? securityConsole.GetHostSecurityProfile() : null);
|
|
}
|
|
SaLogger.Debug($"{SysUtil.Fn} User: '{UserDisplayName}' [Id: {UserId}]" + (SysId.IsValid(previousUserId) ? ". Previous UserId: " + SysId.ToString(previousUserId) : ""));
|
|
|
|
}
|
|
protected void RefreshProfile(SbmSessionConsole sessionConsole, SaSecurityProfile userSecurityProfile, SaSecurityProfile hostSecurityProfile)
|
|
{
|
|
UserDisplayName = (userSecurityProfile?.Description ?? userNameUnknown);
|
|
UserLocation = StringUtil.NullOnBlank(userSecurityProfile?.Location ?? "");
|
|
UserLastLogin = (userSecurityProfile?.LastLogin ?? DateTime.MinValue);
|
|
UserProfile.Populate(userSecurityProfile);
|
|
if (hostSecurityProfile != null)
|
|
HostProfile = new SecurityProfileData(hostSecurityProfile);
|
|
RefreshProfileSettings(sessionConsole);
|
|
}
|
|
private void RefreshProfileSettings(SbmSessionConsole sessionConsole)
|
|
{
|
|
RefreshAdminProfile(sessionConsole);
|
|
RefreshManageProfile(sessionConsole);
|
|
RefreshFinancialProfile(sessionConsole);
|
|
RefreshContactsProfile(sessionConsole);
|
|
RefreshTransactionProfile(sessionConsole);
|
|
RefreshItemTypeProfile(sessionConsole);
|
|
// ToDo Commodities.
|
|
}
|
|
private void ClearProfile()
|
|
{
|
|
// Reset security profiles.
|
|
Admin = new AdminProfile();
|
|
Manage = new ManageProfile();
|
|
Financial = new FinancialProfile();
|
|
Contacts = new ContactsProfile();
|
|
Transaction = new TransactionsProfile();
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
/// <summary>
|
|
/// Registered Security Rights to identify code for enumerated right.
|
|
/// <para> Optinised for speed of conversin and serialised storage.</para>
|
|
/// </summary>
|
|
[JsonProperty("SecurityRights")]
|
|
public Dictionary<int, String> SecurityRights { get; private set; } = new Dictionary<int, string>();
|
|
private void PopulateSecurityRights(List<SaSecurityRight> rights)
|
|
{
|
|
SecurityRights = rights.ToDictionary(item => item.Type, item => item.Code);
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
// Security Profiles.
|
|
// Profile properties are stored locally in such a way to allow serialisation/deserialisation
|
|
// and application of security rules without having to duplicate the complete Security Profile.
|
|
|
|
public class SecurityProfileData
|
|
{
|
|
public SecurityProfileData() { }
|
|
public SecurityProfileData(SaSecurityProfile securityProfile)
|
|
{
|
|
Populate(securityProfile);
|
|
}
|
|
// Security.
|
|
/// <summary>Is the Security Right code granted access for the Data item (if specified).</summary>
|
|
public bool IsSecurityRightGranted(String rightCode, SysId dataItemId = null)
|
|
{
|
|
if (SystemAdmin ?? false) return true;
|
|
return ((Groups != null && Groups.Any(item => item.Rights.IsSecurityRightGranted(rightCode, dataItemId))) || (Rights != null && Rights.IsSecurityRightGranted(rightCode, dataItemId)));
|
|
}
|
|
/// <summary>Is the Security Right code denined access for the Data item (if specified).</summary>
|
|
public bool IsSecurityRightDenied(String rightCode, SysId dataItemId = null)
|
|
{
|
|
if (SystemAdmin ?? false) return false;
|
|
return ((Groups != null && Groups.Any(item => item.Rights.IsSecurityRightDenied(rightCode, dataItemId))) || (Rights != null && Rights.IsSecurityRightDenied(rightCode, dataItemId)));
|
|
}
|
|
// Population.
|
|
public void Populate(SaSecurityProfile securityProfile)
|
|
{
|
|
Clear();
|
|
if (securityProfile.SystemAdmin)
|
|
SystemAdmin = true;
|
|
foreach (var group in securityProfile.Groups)
|
|
{
|
|
GroupData groupData = new GroupData() { Code = group.Code };
|
|
groupData.Rights.Populate(group.Rights);
|
|
Groups.Add(groupData);
|
|
}
|
|
Rights.Populate(securityProfile.Rights);
|
|
}
|
|
public void Clear()
|
|
{
|
|
SystemAdmin = null;
|
|
Groups.Clear();
|
|
Rights.Clear();
|
|
}
|
|
// Properties.
|
|
public bool? SystemAdmin { get; private set; }
|
|
public class GroupData
|
|
{
|
|
public String Code { get; set; }
|
|
public RightsData Rights { get; set; } = new RightsData();
|
|
}
|
|
public List<GroupData> Groups { get; private set; } = new List<GroupData>();
|
|
public class RightData
|
|
{
|
|
public SysId DataItemId { get; set; }
|
|
}
|
|
public class RightsData
|
|
{
|
|
// Construction.
|
|
public RightsData() { }
|
|
public RightsData(IEnumerable<SaSecurityProfile.RightData> rights)
|
|
{
|
|
Populate(rights);
|
|
}
|
|
// Security.
|
|
public bool IsSecurityRightGranted(String rightCode, SysId dataItemId)
|
|
{
|
|
return Granted != null && (Granted.GetValueOrDefault(rightCode)?.Any(item => SysId.ToInt(dataItemId) == SysId.ToInt(item.DataItemId)) ?? false);
|
|
}
|
|
public bool IsSecurityRightDenied(String rightCode, SysId dataItemId)
|
|
{
|
|
return Denied != null && (Denied.GetValueOrDefault(rightCode)?.Any(item => SysId.ToInt(dataItemId) == SysId.ToInt(item.DataItemId)) ?? false);
|
|
}
|
|
// Population.
|
|
public void Populate(IEnumerable<SaSecurityProfile.RightData> rights)
|
|
{
|
|
Clear();
|
|
foreach (var right in rights)
|
|
{
|
|
RightData rightData = new RightData() { DataItemId = SysId.IsValid(right.DataItemId) ? right.DataItemId : null };
|
|
if (right.Granted)
|
|
{
|
|
if (Granted == null) Granted = new Dictionary<string, List<RightData>>();
|
|
if (!Granted.ContainsKey(right.Code)) Granted[right.Code] = new List<RightData>();
|
|
Granted[right.Code].Add(rightData);
|
|
}
|
|
else
|
|
{
|
|
if (Denied == null) Denied = new Dictionary<string, List<RightData>>();
|
|
if (!Denied.ContainsKey(right.Code)) Denied[right.Code] = new List<RightData>();
|
|
Denied[right.Code].Add(rightData);
|
|
}
|
|
}
|
|
}
|
|
public void Clear()
|
|
{
|
|
Granted = null;
|
|
Denied = null;
|
|
}
|
|
public Dictionary<String, List<RightData>> Granted { get; private set; }
|
|
public Dictionary<String, List<RightData>> Denied { get; private set; }
|
|
}
|
|
public RightsData Rights { get; private set; } = new RightsData();
|
|
}
|
|
// User and Host profiles.
|
|
public SecurityProfileData UserProfile { get; private set; } = new SecurityProfileData();
|
|
public SecurityProfileData HostProfile { get; private set; }
|
|
|
|
//-------------------------------------------------------------------
|
|
// Utilities.
|
|
public String GetSecurityRightCode(Sbm.SecurityRight securityRight)
|
|
{
|
|
return SecurityRights.GetValueOrDefault((int)securityRight) ?? "";
|
|
}
|
|
public bool IsSecurityRightGranted(Sbm.SecurityRight securityRight, SysId id = null)
|
|
{
|
|
if (UserProfile != null)
|
|
return UserProfile.IsSecurityRightGranted(GetSecurityRightCode(securityRight), id);
|
|
return false;
|
|
}
|
|
public bool IsSecurityRightDenied(Sbm.SecurityRight securityRight, SysId id = null)
|
|
{
|
|
if (UserProfile != null)
|
|
return UserProfile.IsSecurityRightDenied(GetSecurityRightCode(securityRight), id);
|
|
return true;
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
// Security rights - Admin.
|
|
public class AdminProfile
|
|
{
|
|
internal AdminProfile() { }
|
|
public bool? ManageSecurity { get; internal set; }
|
|
public bool? ManageDatabase { get; internal set; }
|
|
public bool? ManageReferenceData { get; internal set; }
|
|
public bool? ManageInterfaces { get; internal set; }
|
|
}
|
|
public AdminProfile Admin { get; internal set; }
|
|
private void RefreshAdminProfile(SbmSessionConsole sessionConsole)
|
|
{
|
|
if (UserHasSecurityRight(Sbm.SecurityRight.Security_Admin))
|
|
Admin.ManageSecurity = true;
|
|
if (UserHasSecurityRight(Sbm.SecurityRight.Database_Admin))
|
|
Admin.ManageDatabase = true;
|
|
if (UserHasSecurityRight(Sbm.SecurityRight.ReferenceData_Admin))
|
|
Admin.ManageReferenceData = true;
|
|
if (UserHasSecurityRight(Sbm.SecurityRight.InterfaceConfig))
|
|
Admin.ManageInterfaces = true;
|
|
}
|
|
// Admin.
|
|
public bool UserCanManageSecurity() { return Admin.ManageSecurity ?? false; }
|
|
public bool UserCanManageDatabase() { return Admin.ManageDatabase ?? false; }
|
|
public bool UserCanManageReferenceData() { return Admin.ManageReferenceData ?? false; }
|
|
public bool UserCanManageInterfaces() { return Admin.ManageInterfaces ?? false; }
|
|
|
|
//-------------------------------------------------------------------
|
|
// Security rights - Manage.
|
|
public class ManageProfile
|
|
{
|
|
internal ManageProfile() { }
|
|
public bool? CanManageTasks { get; internal set; }
|
|
public bool? CanManageTimesheets { get; internal set; }
|
|
}
|
|
public ManageProfile Manage { get; internal set; }
|
|
private void RefreshManageProfile(SbmSessionConsole sessionConsole)
|
|
{
|
|
if (UserHasSecurityRight(Sbm.SecurityRight.TaskManager))
|
|
Manage.CanManageTasks = true;
|
|
if (UserHasSecurityRight(Sbm.SecurityRight.TimesheetManager))
|
|
Manage.CanManageTimesheets = true;
|
|
}
|
|
// Manage.
|
|
public bool UserCanManageTasks() { return Manage.CanManageTasks ?? false; }
|
|
public bool UserCanManageTimesheets() { return Manage.CanManageTimesheets ?? false; }
|
|
|
|
//-------------------------------------------------------------------
|
|
// Security rights - Financials.
|
|
public class FinancialProfile
|
|
{
|
|
internal FinancialProfile() { }
|
|
public bool? ViewFinancials { get; internal set; }
|
|
public bool? UpdateFinancials { get; internal set; }
|
|
public bool? ViewCommoditySupplyFinancials { get; internal set; }
|
|
public bool? UpdateCommoditySupplyFinancials { get; internal set; }
|
|
public bool? ViewCommoditySalesFinancials { get; internal set; }
|
|
public bool? UpdateCommoditySalesFinancials { get; internal set; }
|
|
public bool? FinancialsAccessControl { get; internal set; }
|
|
}
|
|
public FinancialProfile Financial { get; internal set; }
|
|
private void RefreshFinancialProfile(SbmSessionConsole sessionConsole)
|
|
{
|
|
if (UserHasSecurityRight(Sbm.SecurityRight.Financial_View))
|
|
Financial.ViewFinancials = true;
|
|
if (UserHasSecurityRight(Sbm.SecurityRight.Financial_Update))
|
|
Financial.UpdateFinancials = true;
|
|
if (UserCanAccessFinancialViewOfType(Sbm.FinancialType.CommoditySupply))
|
|
Financial.ViewCommoditySupplyFinancials = true;
|
|
if (UserCanAccessFinancialUpdateOfType(Sbm.FinancialType.CommoditySupply))
|
|
Financial.UpdateCommoditySupplyFinancials = true;
|
|
if (UserCanAccessFinancialViewOfType(Sbm.FinancialType.CommoditySales))
|
|
Financial.ViewCommoditySalesFinancials = true;
|
|
if (UserCanAccessFinancialUpdateOfType(Sbm.FinancialType.CommoditySales))
|
|
Financial.UpdateCommoditySalesFinancials = true;
|
|
// Config options.
|
|
if ((sessionConsole != null && !sessionConsole.AllowOption(Sbm.ConfigOption.FinancialsAccessControl)))
|
|
Financial.FinancialsAccessControl = true;
|
|
}
|
|
|
|
private bool UserCanAccessFinancialViewOfType(Sbm.FinancialType financialType)
|
|
{
|
|
if ((int)financialType < 1) return false;
|
|
// If specific type of financial is requested, check that view is not denied.
|
|
if (IsSecurityRightDenied(Sbm.SecurityRight.Financial_ViewByType, new SysId((int)financialType)))
|
|
return false;
|
|
return true;
|
|
}
|
|
|
|
private bool UserCanAccessFinancialUpdateOfType(Sbm.FinancialType financialType)
|
|
{
|
|
if ((int)financialType < 1) return false;
|
|
// If specific type of financial is requested, check that update is not denied.
|
|
if (IsSecurityRightDenied(Sbm.SecurityRight.Financial_UpdateByType, new SysId((int)financialType)))
|
|
return false;
|
|
return true;
|
|
}
|
|
|
|
/// <summary>Does the user have sufficient rights to view the specified financials.</summary>
|
|
public bool UserCanViewFinancials(Sbm.FinancialType financialType = Sbm.FinancialType.Any)
|
|
{
|
|
if (!Financial.FinancialsAccessControl ?? false) return true;
|
|
if ((Financial.UpdateFinancials ?? false) || (Financial.ViewFinancials ?? false))
|
|
{
|
|
// If specific type of financial is requested, check that view access is not denied.
|
|
if (financialType == Sbm.FinancialType.CommoditySupply)
|
|
return Financial.ViewCommoditySupplyFinancials ?? false;
|
|
else if (financialType == Sbm.FinancialType.CommoditySales)
|
|
return Financial.ViewCommoditySalesFinancials ?? false;
|
|
else return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/// <summary>Does the user have sufficient rights to update the specified financials.</summary>
|
|
public bool UserCanUpdateFinancials(Sbm.FinancialType financialType = Sbm.FinancialType.Any)
|
|
{
|
|
if (!Financial.FinancialsAccessControl ?? false) return true;
|
|
if (Financial.UpdateFinancials ?? false)
|
|
{
|
|
// If specific type of financial is requested, check that update access is not denied.
|
|
if (financialType == Sbm.FinancialType.CommoditySupply)
|
|
return Financial.UpdateCommoditySupplyFinancials ?? false;
|
|
else if (financialType == Sbm.FinancialType.CommoditySales)
|
|
return Financial.UpdateCommoditySalesFinancials ?? false;
|
|
else return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
// Security rights - Contacts.
|
|
public class ContactsProfile
|
|
{
|
|
internal ContactsProfile() { }
|
|
public bool? Create { get; internal set; }
|
|
public bool? Update { get; internal set; }
|
|
}
|
|
public ContactsProfile Contacts { get; internal set; }
|
|
private void RefreshContactsProfile(SbmSessionConsole sessionConsole)
|
|
{
|
|
if (UserHasSecurityRight(Sbm.SecurityRight.Affiliate_Update))
|
|
Contacts.Update = true;
|
|
if (Contacts.Update ?? false || UserHasSecurityRight(Sbm.SecurityRight.Affiliate_Create))
|
|
Contacts.Create = true;
|
|
}
|
|
// Contacts.
|
|
public bool UserCanCreateContacts() { return Contacts.Create ?? false; }
|
|
public bool UserCanUpdateContacts() { return Contacts.Update ?? false; }
|
|
|
|
//-------------------------------------------------------------------
|
|
// Security rights - Transactions.
|
|
public class TransactionsProfile
|
|
{
|
|
internal TransactionsProfile() { }
|
|
public bool? Create { get; internal set; }
|
|
public bool? Update { get; internal set; }
|
|
}
|
|
public TransactionsProfile Transaction { get; internal set; }
|
|
private void RefreshTransactionProfile(SbmSessionConsole sessionConsole)
|
|
{
|
|
if ((UserHasSecurityRight(Sbm.SecurityRight.Transaction_Update)))
|
|
Transaction.Update = true;
|
|
if ((Transaction.Update ?? false || UserHasSecurityRight(Sbm.SecurityRight.Transaction_View)))
|
|
Transaction.Create = true;
|
|
}
|
|
// Transactions.
|
|
public bool UserCanAccessTransactionsOfType(Sbm.TransactionType transactionType)
|
|
{
|
|
if ((int)transactionType < 1) return false;
|
|
// Check if specific type of transaction is denied.
|
|
if (IsSecurityRightDenied(Sbm.SecurityRight.Transaction_ByType, new SysId((int)transactionType)))
|
|
return false;
|
|
return true;
|
|
}
|
|
public bool CanUpdateTransactionTypeStatusCat(Sbm.TransactionType transactionType, SbmTransaction.StatusCat transactionStatusCat)
|
|
{
|
|
SysId transactionTypeStatusCatId = SbmTransaction.GetTransactionTypeStatusId(transactionType, transactionStatusCat);
|
|
|
|
// Check if update of this transaction type and status is denied:
|
|
if (IsSecurityRightDenied(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, transactionTypeStatusCatId))
|
|
return false;
|
|
|
|
// Check if update of this transaction type and status is explicitly allowed:
|
|
if (IsSecurityRightGranted(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, transactionTypeStatusCatId))
|
|
return true;
|
|
|
|
// Check if any other statuses for this type of transaction are allowed.
|
|
foreach (TypeCodeDesc statusCat in SbmTransaction.GetTransactionStatusCats(transactionType))
|
|
{
|
|
SbmTransaction.StatusCat transactionStatusCatOther = (SbmTransaction.StatusCat)statusCat.Type;
|
|
// Ignore the transaction status category.
|
|
if (transactionStatusCatOther == transactionStatusCat) continue;
|
|
if (IsSecurityRightGranted(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, SbmTransaction.GetTransactionTypeStatusId(transactionType, transactionStatusCatOther)))
|
|
// Explicit granting of right to another status for this transaction right
|
|
// implies that other statuses are implicitly denied.
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
// Security rights - ItemType.
|
|
public class ItemTypesProfile
|
|
{
|
|
internal ItemTypesProfile() { }
|
|
public bool? Create { get; internal set; }
|
|
public bool? Update { get; internal set; }
|
|
public bool? Remove { get; internal set; }
|
|
// Config options.
|
|
public bool? Processes { get; internal set; }
|
|
public bool? Contacts { get; internal set; }
|
|
public bool? Commodities { get; internal set; }
|
|
public bool? Portfolios { get; internal set; }
|
|
public bool? PriceSets { get; internal set; }
|
|
public bool? CommodityCustomers { get; internal set; }
|
|
public bool? CommoditySuppliers { get; internal set; }
|
|
public bool? Transactions { get; internal set; }
|
|
public bool? Assets { get; internal set; }
|
|
public bool? Vehicles { get; internal set; }
|
|
public bool? StockLocations { get; internal set; }
|
|
public bool? StockContainers { get; internal set; }
|
|
public bool? StockControl { get; internal set; }
|
|
}
|
|
public ItemTypesProfile ItemType { get; } = new ItemTypesProfile();
|
|
private void RefreshItemTypeProfile(SbmSessionConsole sessionConsole)
|
|
{
|
|
if (sessionConsole.AllowOption(Sbm.ConfigOption.Processes))
|
|
ItemType.Processes = true;
|
|
if (sessionConsole.AllowOption(Sbm.ConfigOption.Contacts))
|
|
ItemType.Contacts = true;
|
|
if (sessionConsole.AllowOption(Sbm.ConfigOption.Commodities))
|
|
ItemType.Commodities = true;
|
|
if (sessionConsole.AllowOption(Sbm.ConfigOption.Portfolios))
|
|
ItemType.Portfolios = true;
|
|
if (sessionConsole.AllowOption(Sbm.ConfigOption.PriceSets))
|
|
ItemType.PriceSets = true;
|
|
if (sessionConsole.AllowOption(Sbm.ConfigOption.CommodityCustomers))
|
|
ItemType.CommodityCustomers = true;
|
|
if (sessionConsole.AllowOption(Sbm.ConfigOption.CommoditySuppliers))
|
|
ItemType.CommoditySuppliers = true;
|
|
if (sessionConsole.AllowOption(Sbm.ConfigOption.Transactions))
|
|
ItemType.Transactions = true;
|
|
if (sessionConsole.AllowOption(Sbm.ConfigOption.Assets))
|
|
ItemType.Assets = true;
|
|
if (sessionConsole.AllowOption(Sbm.ConfigOption.Vehicles))
|
|
ItemType.Vehicles = true;
|
|
if (sessionConsole.GetStockControlConfig().AllowStockLocations())
|
|
ItemType.StockLocations = true;
|
|
if (sessionConsole.GetStockControlConfig().AllowStockContainers())
|
|
ItemType.StockContainers = true;
|
|
if (sessionConsole.GetStockControlConfig().AllowStockControl())
|
|
ItemType.StockControl = true;
|
|
}
|
|
// Item types.
|
|
public bool UserCanViewItemType(Sbm.ItemType itemType)
|
|
{
|
|
return true;
|
|
}
|
|
public bool UserCanCreateItemType(Sbm.ItemType itemType)
|
|
{
|
|
if (UserProfile?.SystemAdmin ?? false) return true;
|
|
switch (itemType)
|
|
{
|
|
case Sbm.ItemType.SecItem: return IsSecurityRightGranted(Sbm.SecurityRight.Security_Admin);
|
|
case Sbm.ItemType.Currency:
|
|
case Sbm.ItemType.Region:
|
|
case Sbm.ItemType.Language:
|
|
case Sbm.ItemType.TaxCode:
|
|
case Sbm.ItemType.UnitMeasure: return IsSecurityRightGranted(Sbm.SecurityRight.ReferenceData_Admin);
|
|
case Sbm.ItemType.Process: return IsSecurityRightGranted(Sbm.SecurityRight.ReferenceData_Admin);
|
|
case Sbm.ItemType.Affiliate: return IsSecurityRightGranted(Sbm.SecurityRight.Affiliate_Create);
|
|
case Sbm.ItemType.Address: return IsSecurityRightGranted(Sbm.SecurityRight.Affiliate_Update);
|
|
case Sbm.ItemType.Commodity: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Create);
|
|
case Sbm.ItemType.PortfolioItem: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.Location: return IsSecurityRightGranted(Sbm.SecurityRight.ReferenceData_Admin);
|
|
case Sbm.ItemType.Container: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Create);
|
|
case Sbm.ItemType.ContainerItem: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.Movement: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.StockLevel: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.PriceSet:
|
|
case Sbm.ItemType.Price: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update) && UserCanUpdateFinancials();
|
|
case Sbm.ItemType.CommodityCustomer:
|
|
case Sbm.ItemType.CommoditySupplier: return IsSecurityRightGranted(Sbm.SecurityRight.Association_Update) && IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.Association: return IsSecurityRightGranted(Sbm.SecurityRight.Association_Create);
|
|
case Sbm.ItemType.Transaction: return IsSecurityRightGranted(Sbm.SecurityRight.Transaction_Create);
|
|
case Sbm.ItemType.Requirement:
|
|
case Sbm.ItemType.Constituent: return IsSecurityRightGranted(Sbm.SecurityRight.Transaction_Update);
|
|
case Sbm.ItemType.SystemAccount:
|
|
case Sbm.ItemType.SystemUser:
|
|
case Sbm.ItemType.SystemAccountUser: return IsSecurityRightGranted(Sbm.SecurityRight.Security_Admin);
|
|
case Sbm.ItemType.AssetCategory:
|
|
case Sbm.ItemType.AssetCategoryProcess:
|
|
case Sbm.ItemType.Asset:
|
|
case Sbm.ItemType.AssetProcess: return IsSecurityRightGranted(Sbm.SecurityRight.Asset_Create);
|
|
case Sbm.ItemType.VehicleClass:
|
|
case Sbm.ItemType.Vehicle:
|
|
case Sbm.ItemType.VehicleEvent:
|
|
case Sbm.ItemType.VehicleFeature: return IsSecurityRightGranted(Sbm.SecurityRight.Asset_Create);
|
|
case Sbm.ItemType.CommodityProcess: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.RequirementProcess: return IsSecurityRightGranted(Sbm.SecurityRight.Transaction_Update);
|
|
case Sbm.ItemType.Interface: return IsSecurityRightGranted(Sbm.SecurityRight.InterfaceConfig);
|
|
}
|
|
return false;
|
|
}
|
|
public bool UserCanUpdateItemType(Sbm.ItemType itemType)
|
|
{
|
|
if (UserProfile?.SystemAdmin ?? false) return true;
|
|
switch (itemType)
|
|
{
|
|
case Sbm.ItemType.SecItem: return IsSecurityRightGranted(Sbm.SecurityRight.Security_Admin);
|
|
case Sbm.ItemType.Currency:
|
|
case Sbm.ItemType.Region:
|
|
case Sbm.ItemType.Language:
|
|
case Sbm.ItemType.TaxCode:
|
|
case Sbm.ItemType.UnitMeasure: return IsSecurityRightGranted(Sbm.SecurityRight.ReferenceData_Admin);
|
|
case Sbm.ItemType.Process: return IsSecurityRightGranted(Sbm.SecurityRight.ReferenceData_Admin);
|
|
case Sbm.ItemType.Affiliate:
|
|
case Sbm.ItemType.Address: return IsSecurityRightGranted(Sbm.SecurityRight.Affiliate_Update);
|
|
case Sbm.ItemType.Commodity: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.PortfolioItem: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.Location: return IsSecurityRightGranted(Sbm.SecurityRight.ReferenceData_Admin);
|
|
case Sbm.ItemType.Container:
|
|
case Sbm.ItemType.ContainerItem: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.Movement:
|
|
case Sbm.ItemType.StockLevel: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.PriceSet:
|
|
case Sbm.ItemType.Price: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update) && UserCanUpdateFinancials();
|
|
case Sbm.ItemType.CommodityCustomer:
|
|
case Sbm.ItemType.CommoditySupplier: return IsSecurityRightGranted(Sbm.SecurityRight.Association_Update) && IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.Association: return IsSecurityRightGranted(Sbm.SecurityRight.Association_Update);
|
|
case Sbm.ItemType.Transaction:
|
|
case Sbm.ItemType.Requirement:
|
|
case Sbm.ItemType.Constituent: return IsSecurityRightGranted(Sbm.SecurityRight.Transaction_Update);
|
|
case Sbm.ItemType.SystemAccount:
|
|
case Sbm.ItemType.SystemUser:
|
|
case Sbm.ItemType.SystemAccountUser: return IsSecurityRightGranted(Sbm.SecurityRight.Security_Admin);
|
|
case Sbm.ItemType.AssetCategory:
|
|
case Sbm.ItemType.AssetCategoryProcess:
|
|
case Sbm.ItemType.Asset:
|
|
case Sbm.ItemType.AssetProcess: return IsSecurityRightGranted(Sbm.SecurityRight.Asset_Update);
|
|
case Sbm.ItemType.VehicleClass:
|
|
case Sbm.ItemType.Vehicle:
|
|
case Sbm.ItemType.VehicleEvent:
|
|
case Sbm.ItemType.VehicleFeature: return IsSecurityRightGranted(Sbm.SecurityRight.Asset_Update);
|
|
case Sbm.ItemType.CommodityProcess: return IsSecurityRightGranted(Sbm.SecurityRight.Commodity_Update);
|
|
case Sbm.ItemType.RequirementProcess: return IsSecurityRightGranted(Sbm.SecurityRight.Transaction_Update);
|
|
case Sbm.ItemType.Interface: return IsSecurityRightGranted(Sbm.SecurityRight.InterfaceConfig);
|
|
}
|
|
return false;
|
|
}
|
|
|
|
public bool UserCanRemoveItemType(Sbm.ItemType itemType)
|
|
{
|
|
switch (itemType)
|
|
{
|
|
case Sbm.ItemType.Transaction:
|
|
if (!IsSecurityRightGranted(Sbm.SecurityRight.Transaction_Remove)) return false;
|
|
break;
|
|
}
|
|
return (UserCanCreateItemType(itemType) && UserCanUpdateItemType(itemType));
|
|
}
|
|
|
|
|
|
//-------------------------------------------------------------------
|
|
// Security rights.
|
|
public bool UserHasSecurityRight(Sbm.SecurityRight securityRight, SysId dataItemId = null)
|
|
{
|
|
String rightCode = GetSecurityRightCode(securityRight);
|
|
if (StringUtil.IsEmpty(rightCode)) return false;
|
|
// Check if right is denied by either user or host profiles.
|
|
if (UserProfile?.IsSecurityRightDenied(rightCode) ?? false) return false;
|
|
if (HostProfile?.IsSecurityRightDenied(rightCode) ?? false) return false;
|
|
// Check if right is granted by either user or host profiles.
|
|
if (UserProfile?.IsSecurityRightGranted(rightCode) ?? false) return true;
|
|
if (HostProfile?.IsSecurityRightGranted(rightCode) ?? false) return true;
|
|
return false;
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
public class SecurityProfileException : Exception
|
|
{
|
|
public SecurityProfileException(string message) : base(message) { }
|
|
}
|
|
/// <summary>Verify that the specified profiles matches this one, eg. after deserialisation.</summary>
|
|
public bool CompareProfiles(ISbmSecurityProfile_Core securityProfile_Core)
|
|
{
|
|
// Profile.
|
|
if (securityProfile_Core == null)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile is null.");
|
|
SbmSecurityProfile securityProfile = securityProfile_Core as SbmSecurityProfile;
|
|
if (securityProfile == null)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile does not match type.");
|
|
|
|
// Security rights.
|
|
if (SecurityRights.Count != securityProfile.SecurityRights.Count)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Security Rights. Expected: {SecurityRights.Count}. Found: {securityProfile.SecurityRights}.");
|
|
|
|
// User profile.
|
|
if (UserProfile != null && securityProfile.UserProfile == null)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile is missing a User Profile.");
|
|
if (UserProfile == null && securityProfile.UserProfile != null)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile includes a User Profile.");
|
|
|
|
// User profile - Groups.
|
|
if (UserProfile.Groups?.Count != securityProfile.UserProfile.Groups?.Count)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of User Groups. Expected: {UserProfile.Groups?.Count}. Found: {securityProfile.UserProfile.Groups?.Count}.");
|
|
|
|
// User profile - Granted Rights.
|
|
if (UserProfile.Rights?.Granted?.Count != securityProfile.UserProfile.Rights?.Granted?.Count)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Granted User Rights. Expected: {UserProfile.Rights?.Granted?.Count}. Found: {securityProfile.UserProfile.Rights?.Granted?.Count}.");
|
|
|
|
// User profile - Denied Rights.
|
|
if (UserProfile.Rights?.Denied?.Count != securityProfile.UserProfile.Rights?.Denied?.Count)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Denied User Rights. Expected: {UserProfile.Rights?.Denied?.Count}. Found: {securityProfile.UserProfile.Rights?.Denied?.Count}.");
|
|
|
|
// Host profile.
|
|
if (HostProfile != null && securityProfile.HostProfile == null)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile is missing a Host Profile.");
|
|
if (HostProfile == null && securityProfile.HostProfile != null)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile includes a Host Profile.");
|
|
|
|
// Host profile - Groups.
|
|
if (HostProfile?.Groups?.Count != securityProfile.HostProfile?.Groups?.Count)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Host Groups. Expected: {HostProfile?.Groups?.Count}. Found: {securityProfile.HostProfile?.Groups?.Count}.");
|
|
|
|
// Host profile - Granted Rights.
|
|
if (HostProfile?.Rights?.Granted?.Count != securityProfile.HostProfile?.Rights?.Granted?.Count)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Granted Host Rights. Expected: {HostProfile?.Rights?.Granted?.Count}. Found: {securityProfile.HostProfile?.Rights?.Granted?.Count}.");
|
|
|
|
// Host profile - Denied Rights.
|
|
if (HostProfile?.Rights?.Denied?.Count != securityProfile.HostProfile?.Rights?.Denied?.Count)
|
|
throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Denied Host Rights. Expected: {HostProfile?.Rights?.Denied?.Count}. Found: {securityProfile.HostProfile?.Rights?.Denied?.Count}.");
|
|
|
|
return true;
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
}
|
|
//=======================================================================
|
|
}
|