300 lines
13 KiB
C#
300 lines
13 KiB
C#
using System;
|
|
using System.Collections.Generic;
|
|
using Sarand.Net.Standard.Base.Core;
|
|
using Sarand.Net.Standard.Base.Bus;
|
|
using Sarand.Net.Standard.Base.Dbas;
|
|
using Sarand.Net.Standard.Base.UpdateLog;
|
|
|
|
namespace Sarand.Net.Standard.Base.Security
|
|
{
|
|
//=======================================================================
|
|
// Definitions.
|
|
public class SaSecurity
|
|
{
|
|
public enum ItemType
|
|
{
|
|
Any = -1,
|
|
Unknown = 0,
|
|
// Values are tied to the database - do not change.
|
|
User = 1,
|
|
Computer = 2,
|
|
Group = 3,
|
|
Right = 4,
|
|
}
|
|
public enum FilterAttrType
|
|
{
|
|
Code, // Partial code.
|
|
Name, // Partial name.
|
|
Group_Include, // Item belongs to group.
|
|
Group_Exclude, // Item doesn't belong to group.
|
|
};
|
|
}
|
|
// Password configuration.
|
|
public class PasswordConfig
|
|
{
|
|
/// <summary>Minimum password length. < 1 = no limit.</summary>
|
|
public int MinimumLength { get; protected set; } = 6;
|
|
/// <summary>Maximum password length. < 1 = no limit.</summary>
|
|
public int MaximumLength { get; protected set; } = 6;
|
|
}
|
|
|
|
//=======================================================================
|
|
public abstract class SaSecurityConsole : SaErrorStateItem
|
|
{
|
|
//-------------------------------------------------------------------
|
|
// Definitions.
|
|
protected class DataItemDfn
|
|
{
|
|
public DataItemDfn(short dataItemType, String caption)
|
|
{
|
|
DataItemType = dataItemType;
|
|
Caption = caption;
|
|
}
|
|
public short DataItemType { get; set; } = -1;
|
|
public String Caption { get; set; } = String.Empty;
|
|
public List<SysIdString> ItemsAssign { get; } = new List<SysIdString>();
|
|
public List<SysIdString> ItemsFull { get; } = new List<SysIdString>();
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
// Data members.
|
|
protected static String GroupSuperCode = "SUPER";
|
|
protected static String AdminUserCode = "admin";
|
|
private static List<TypeCodeDesc> securityItemTypes = new List<TypeCodeDesc>();
|
|
|
|
//-------------------------------------------------------------------
|
|
// Static initialisation
|
|
static SaSecurityConsole()
|
|
{
|
|
// Security item types.
|
|
securityItemTypes.Add(SaSecurity.ItemType.User, "USER", "User");
|
|
securityItemTypes.Add(SaSecurity.ItemType.Computer, "COMP", "Computer");
|
|
securityItemTypes.Add(SaSecurity.ItemType.Group, "SGRP", "Group");
|
|
securityItemTypes.Add(SaSecurity.ItemType.Right, "SRGT", "Right");
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
// Protected construction - use derived classes.
|
|
protected SaSecurityConsole()
|
|
{
|
|
}
|
|
protected override void Dispose(bool disposing)
|
|
{
|
|
if (disposing)
|
|
{
|
|
}
|
|
base.Dispose(disposing);
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
// Properties.
|
|
public bool LogSecurityProfile { get; set; } = false;
|
|
public abstract short SecurityItemDataType { get; }
|
|
public abstract short SecurityLinkDataType { get; }
|
|
public abstract SaUpdateLogConsole UpdateLogConsole { get; }
|
|
public static List<TypeCodeDesc> SecurityItemTypes { get { return new List<TypeCodeDesc>(securityItemTypes); } }
|
|
#if DEBUG
|
|
// Login dialog has a 'Require debug login' option.
|
|
public bool RequireDebugLogin { get; protected set; } = true;
|
|
#endif
|
|
protected List<SaSecurityRight> RegisteredRights { get; } = new List<SaSecurityRight>();
|
|
protected Dictionary<short, DataItemDfn> DataItemDfns { get; } = new Dictionary<short, DataItemDfn>();
|
|
|
|
//-------------------------------------------------------------------
|
|
// Database properties.
|
|
public abstract bool DatabaseIsValid { get; }
|
|
public abstract bool CanUpdateDatabase { get; }
|
|
public abstract bool ColumnExists(SaSecurityDbDfn.ColumnIdx columnIdx);
|
|
|
|
//-------------------------------------------------------------------
|
|
// U t i l i t i e s
|
|
//-------------------------------------------------------------------
|
|
// Default user Id.
|
|
private SysId userIdDefault = new SysId();
|
|
public SysId GetUserIdDefault()
|
|
{
|
|
return userIdDefault;
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
// L o g i n
|
|
//-------------------------------------------------------------------
|
|
/// <summary>User login.</summary>
|
|
public abstract bool LoginUser(SysId userId, bool recordLastLogin = true);
|
|
/// <summary>Using current windows user account.</summary>
|
|
public abstract bool LoginAuthenticatedUser();
|
|
protected abstract bool OnLogin(SysId userId);
|
|
/// <summary>Logout - Clear user and security details.</summary>
|
|
public abstract bool LogoutUser();
|
|
protected abstract void OnLogout();
|
|
|
|
//-------------------------------------------------------------------
|
|
// A p p l i c a t i o n I n t e r f a c e
|
|
//-------------------------------------------------------------------
|
|
/// <summary>Show Login form.</summary>
|
|
public abstract bool ManageSecurity(bool userCanManageSecurity, DbUpdateInfo dbUpdateInfo);
|
|
/// <summary>Show Security maintenance form.</summary>
|
|
public abstract bool ShowUserLoginForm(DbUpdateInfo dbUpdateInfo);
|
|
/// <summary>User modified event.</summary>
|
|
public abstract bool OnUserModified(SysId userId);
|
|
/// <summary>Security Group modified event.</summary>
|
|
public abstract bool OnSecurityGroupModified(SysId userId);
|
|
|
|
//-------------------------------------------------------------------
|
|
// Password configuration.
|
|
public PasswordConfig PasswordConfig { get; protected set; } = new PasswordConfig();
|
|
/// <summary>Show form to change password for currently logged in user.</summary>
|
|
/// <returns>Flag to indicate password changed</returns>
|
|
public abstract bool ShowChangePasswordForm(DbUpdateInfo dbUpdateInfo);
|
|
|
|
//-------------------------------------------------------------------
|
|
// A p p l i c a t i o n S e c u r i t y R i g h t s
|
|
//-------------------------------------------------------------------
|
|
// Register Security Rights.
|
|
public abstract void RegisterSecurityRights();
|
|
//-------------------------------------------------------------------
|
|
// Security rights are optionally associated with a specified data item type (>0),
|
|
// in which case they are always associated with a specific item Id of that type.
|
|
public bool RegisterSecurityRight(int type, String code, String desc, short dataItemType = 0)
|
|
{
|
|
RegisteredRights.Add(type, code, desc, dataItemType);
|
|
return true;
|
|
}
|
|
public List<SaSecurityRight> GetRegisteredRights()
|
|
{
|
|
return new List<SaSecurityRight>(RegisteredRights);
|
|
}
|
|
// Replace previous rights.
|
|
public bool RegisterSecurityRights(List<SaSecurityRight> securityRights)
|
|
{
|
|
RegisteredRights.Clear();
|
|
RegisteredRights.AddRange(securityRights);
|
|
return true;
|
|
}
|
|
// Determine whether any security items are present and allow them to be populated.
|
|
public abstract bool RequiresPopulation();
|
|
public abstract bool PopulateSecurityRights(DbUpdateInfo dbUpdateInfo);
|
|
|
|
//-------------------------------------------------------------------
|
|
// A p p l i c a t i o n D a t a I t e m s
|
|
//-------------------------------------------------------------------
|
|
// Application data items - as referenced by assigned security rights (where relevant).
|
|
// Items assign: Register the list of application data items of a particular type that can be associated with security rights.
|
|
// Items full: If specified, only data items in the 'assign' list can be associated with security items and existing security
|
|
// items that reference data items in the 'full' list but not in the 'assign' list cannot be modified.
|
|
public bool RegisterDataItemType(short dataItemType, String caption, List<SysIdString> itemsAssign = null, List<SysIdString> itemsFull = null)
|
|
{
|
|
DataItemDfn dataItemDfn = new DataItemDfn(dataItemType, caption);
|
|
if (itemsAssign != null)
|
|
dataItemDfn.ItemsAssign.AddRange(itemsAssign);
|
|
if (itemsFull != null)
|
|
dataItemDfn.ItemsFull.AddRange(itemsFull);
|
|
DataItemDfns.Add(dataItemType, dataItemDfn);
|
|
return true;
|
|
}
|
|
// Modify list of data item associated with specified type.
|
|
public bool RegisterDataItems(short dataItemType, List<SysIdString> itemsAssign, List<SysIdString> itemsFull = null)
|
|
{
|
|
if (!DataItemDfns.ContainsKey(dataItemType)) return false;
|
|
DataItemDfn dataItemDfn = DataItemDfns[dataItemType];
|
|
// Clear and repopulate assignable items.
|
|
dataItemDfn.ItemsAssign.Clear();
|
|
if (itemsAssign != null)
|
|
dataItemDfn.ItemsAssign.AddRange(itemsAssign);
|
|
// Clear and populate full list of items.
|
|
dataItemDfn.ItemsFull.Clear();
|
|
if (itemsFull != null)
|
|
dataItemDfn.ItemsFull.AddRange(itemsFull);
|
|
return true;
|
|
}
|
|
|
|
//-------------------------------------------------------------------
|
|
// U s e r S e c u r i t y P r o f i l e
|
|
//-------------------------------------------------------------------
|
|
/// <summary>Retrieve security profile for host computer</summary>
|
|
public abstract SaSecurityProfile GetHostSecurityProfile();
|
|
/// <summary>Retrieve security profile for specified user</summary>
|
|
public abstract SaSecurityProfile GetUserSecurityProfile(SysId userId);
|
|
/// <summary>Internal only - creat securitu profile.</summary>
|
|
protected SaSecurityProfile CreateSecurityProfile(SaSecurityItem secItem, List<SaSecurityProfile.GroupData> profileGroups, List<SaSecurityProfile.RightData> profileRights, bool systemAdmin)
|
|
{
|
|
return new SaSecurityProfile(secItem, profileGroups, profileRights, systemAdmin);
|
|
}
|
|
/*
|
|
// The security profile applies right by user and then host computer (if not defined by user).
|
|
public bool IsSecurityRightGranted (String rightCode, SysId dataItemId = null)
|
|
{
|
|
#if DEBUG
|
|
if (!RequireDebugLogin) return true;
|
|
#endif
|
|
if (UserSecurityProfile.IsSecurityRightGranted(rightCode, dataItemId)) return true;
|
|
if (HostSecurityProfile.IsSecurityRightGranted(rightCode, dataItemId)) return true;
|
|
return false;
|
|
}
|
|
public bool IsSecurityRightDenied (String rightCode, SysId dataItemId = null)
|
|
{
|
|
#if DEBUG
|
|
if (!RequireDebugLogin) return false;
|
|
#endif
|
|
if (UserSecurityProfile.IsSecurityRightDenied(rightCode, dataItemId)) return true;
|
|
if (HostSecurityProfile.IsSecurityRightDenied(rightCode, dataItemId)) return true;
|
|
return false;
|
|
}
|
|
// Retrieve the list of data items for which the user is explicitly granted the
|
|
// specified security right, or where the right is explicitly denied if the flag is false.
|
|
// NB If both lists are empty, assume that user is granted the right to all data items.
|
|
public List<SysId> GetDataItemsForRight (String rightCode, bool granted = true)
|
|
{
|
|
List<SysId> dataItemIds = UserSecurityProfile.GetDataItemsForRight (rightCode, granted);
|
|
dataItemIds.AddIds(HostSecurityProfile.GetDataItemsForRight(rightCode, granted));
|
|
return dataItemIds;
|
|
}
|
|
*/
|
|
|
|
//-------------------------------------------------------------------
|
|
// S e c u r i t y I t e m s
|
|
//-------------------------------------------------------------------
|
|
// Security items (user, computer, group or right).
|
|
public bool SecurityItemCodeExists(SaSecurity.ItemType securityItemType, String userCode)
|
|
{
|
|
return SysId.IsValid(GetIdForItemCode(securityItemType, userCode));
|
|
}
|
|
public SaSecurityItem GetUserByCode(String code)
|
|
{
|
|
return GetSecurityItemByCode(SaSecurity.ItemType.User, code);
|
|
}
|
|
public abstract SaSecurityItem GetUserByEmail(String emailAddress);
|
|
public abstract SaSecurityItem GetSecurityItemById(SaSecurity.ItemType securityItemType, SysId id);
|
|
public abstract SaSecurityItem GetSecurityItemByCode(SaSecurity.ItemType securityItemType, String code);
|
|
public abstract SaSecurityItem GetSecurityItem(SaSecurityItem.Params prm);
|
|
// Security item properties.
|
|
public abstract SysId GetIdForItemCode(SaSecurity.ItemType securityItemType, string code);
|
|
public abstract String GetCodeForItemId(SysId securityItemId);
|
|
public abstract String GetNameForItemId(SysId securityItemId);
|
|
public abstract Dictionary<SysId, String> GetSecurityItemDescriptions(List<SysId> securityItemIds);
|
|
// Security Item list.
|
|
public abstract ColumnDfn GetSecurityItemColumnDfn(SaSecurityItem.Column columnId, String caption = "", int width = 0);
|
|
public abstract long GetSecurityItemCount(SaSecurityItem.Params prm);
|
|
public abstract List<SaSecurityItem> GetSecurityItemList(SaSecurityItem.Params prm);
|
|
public abstract DbResultSet ExecuteSecurityItemQuery(List<ColumnDfn> columns, SaSecurityItem.Params prm);
|
|
public abstract DataValue GetSecurityItemDataValue(ColumnDfn column, NamedValue.Map values);
|
|
|
|
//-------------------------------------------------------------------
|
|
// Security item updates.
|
|
public abstract bool CreateUser(String code, String name, DbUpdateInfo dbUpdateInfo);
|
|
public abstract bool AssignUserToGroup(String userCode, String groupCode, DbUpdateInfo dbUpdateInfo);
|
|
public abstract bool UpdateSecurityItem(SaSecurityItem securityItem, DbUpdateInfo dbUpdateInfo);
|
|
|
|
//-------------------------------------------------------------------
|
|
// S e c u r i t y I t e m s L i n k s
|
|
//-------------------------------------------------------------------
|
|
// Security item links.
|
|
public abstract bool ItemsAreLinked(SysId securityItemId1, SysId securityItemId2);
|
|
|
|
//-------------------------------------------------------------------
|
|
|
|
//-------------------------------------------------------------------
|
|
}
|
|
//=======================================================================
|
|
}
|