From 4c8b43a24308550496353be7c27f7f0cbb8adbfc Mon Sep 17 00:00:00 2001 From: Hadi Khazaee Asl Date: Thu, 6 Nov 2025 07:12:31 +0330 Subject: [PATCH] apply fix on Webinars Provider ... --- Controller/XWebinarServiceControllerBase.cs | 224 +++++++++++++++++--- Interfaces/IXWebinarProvider.cs | 28 +-- Providers/XWebinarProvider.cs | 84 +------- 3 files changed, 206 insertions(+), 130 deletions(-) diff --git a/Controller/XWebinarServiceControllerBase.cs b/Controller/XWebinarServiceControllerBase.cs index 8f6d4e7..5d15acc 100644 --- a/Controller/XWebinarServiceControllerBase.cs +++ b/Controller/XWebinarServiceControllerBase.cs @@ -1,4 +1,5 @@ using System; +using System.Linq; using System.Collections.Generic; using System.Threading.Tasks; using Microsoft.AspNetCore.Mvc; @@ -6,6 +7,7 @@ using Microsoft.Extensions.Logging; using xCommons.Configurations; using xCommons.Extensions; using xCommons.Providers; +using xExceptions.Constants; using xIdentityService.Controllers; using xIdentityService.Interfaces; using xModels.Dtos; @@ -60,6 +62,19 @@ namespace xWebinarService.Controller // Do ... try { + // + // Retrieve User Info ... + var userInfo = await GetUserInfo(); + bool isAdmin = userInfo.Roles.Any(r => r.ToNormalString() == "admin"); + var userId = userInfo.UserId; + + // + // Check Owner ... + if (item.OwnerId.IsNullOrEmpty()) + { + item.OwnerId = userId; + } + // var result = await WebinarProvider .CreateWebinar(item); @@ -90,6 +105,20 @@ namespace xWebinarService.Controller // Do ... try { + // + // Retrieve User Info ... + var userInfo = await GetUserInfo(); + bool isAdmin = userInfo.Roles.Any(r => r.ToNormalString() == "admin"); + var userId = userInfo.UserId; + + // + // Check Permission ... + bool has = item.OwnerId == userId || isAdmin; + if (!has) + { + XException.NotAllowed.Throw(); + } + // var result = await WebinarProvider .UpdateWebinar(item); @@ -208,16 +237,31 @@ namespace xWebinarService.Controller try { // - // Retrieve UserInfo ... + // Retrieve User Info ... var userInfo = await GetUserInfo(); - var requesterId = userInfo.UserId; + bool isAdmin = userInfo.Roles.Any(r => r.ToNormalString() == "admin"); + var userId = userInfo.UserId; + + // + // Retrieve Entity ... + var entity = await WebinarProvider.GetWebinar(webinarId); + bool has = !entity.IsNullOrDefault(); + if (!has) + { + XException.NotFound.Throw(); + } + + // + // Check Permissions ... + has = entity.OwnerId == userId || isAdmin; + if (!has) + { + XException.NotAllowed.Throw(); + } // var result = await WebinarProvider - .RemoveWebinar( - webinarId: webinarId, - requesterUserSelectByParam: requesterId - ); + .RemoveWebinar(webinarId); // return Ok(result. @@ -251,16 +295,36 @@ namespace xWebinarService.Controller try { // - // Retrieve UserInfo ... + // Retrieve User Info ... var userInfo = await GetUserInfo(); - var requesterId = userInfo.UserId; + bool isAdmin = userInfo.Roles.Any(r => r.ToNormalString() == "admin"); + var userId = userInfo.UserId; + + // + // Retrieve Entity ... + var entity = await WebinarProvider.GetWebinar(webinarId); + bool has = !entity.IsNullOrDefault(); + if (!has) + { + XException.NotFound.Throw(); + } + + // + // Check Permissions ... + has = + isAdmin || + entity.OwnerId == userId || + entity.Type == Constants.XWebinarType.Public; + if (!has) + { + XException.NotAllowed.Throw(); + } // var result = await WebinarProvider .Subscribe( webinarId: webinarId, - subscriberId: subscriberId, - requesterUserSelectByParam: requesterId + subscriberId: subscriberId ); // @@ -292,9 +356,29 @@ namespace xWebinarService.Controller try { // - // Retrieve UserInfo ... + // Retrieve User Info ... var userInfo = await GetUserInfo(); - var requesterId = userInfo.UserId; + bool isAdmin = userInfo.Roles.Any(r => r.ToNormalString() == "admin"); + var userId = userInfo.UserId; + + // + // Retrieve Entity ... + var entity = await WebinarProvider.GetWebinar(webinarId); + bool has = !entity.IsNullOrDefault(); + if (!has) + { + XException.NotFound.Throw(); + } + + // + // Check Permissions ... + has = + isAdmin || + entity.OwnerId == userId; + if (!has) + { + XException.NotAllowed.Throw(); + } // var result = await WebinarProvider @@ -332,16 +416,36 @@ namespace xWebinarService.Controller try { // - // Retrieve UserInfo ... + // Retrieve User Info ... var userInfo = await GetUserInfo(); - var requesterId = userInfo.UserId; + bool isAdmin = userInfo.Roles.Any(r => r.ToNormalString() == "admin"); + var userId = userInfo.UserId; + + // + // Retrieve Entity ... + var entity = await WebinarProvider.GetWebinar(webinarId); + bool has = !entity.IsNullOrDefault(); + if (!has) + { + XException.NotFound.Throw(); + } + + // + // Check Permissions ... + has = + isAdmin || + subscriberId == userId || + entity.OwnerId == userId; + if (!has) + { + XException.NotAllowed.Throw(); + } // var result = await WebinarProvider .Unsubscribe( webinarId: webinarId, - subscriberId: subscriberId, - requesterUserSelectByParam: requesterId + subscriberId: subscriberId ); // @@ -365,7 +469,7 @@ namespace xWebinarService.Controller [HttpGet("GetSubscriber")] public virtual async Task> GetSubscriber( [FromQuery] Guid webinarId, - [FromQuery] string subscriberId + [FromQuery] string subscriberId ) { // @@ -373,16 +477,35 @@ namespace xWebinarService.Controller try { // - // Retrieve UserInfo ... + // Retrieve User Info ... var userInfo = await GetUserInfo(); - var requesterId = userInfo.UserId; + bool isAdmin = userInfo.Roles.Any(r => r.ToNormalString() == "admin"); + var userId = userInfo.UserId; + + // + // Retrieve Entity ... + var entity = await WebinarProvider.GetWebinar(webinarId); + bool has = !entity.IsNullOrDefault(); + if (!has) + { + XException.NotFound.Throw(); + } + + // + // Check Permissions ... + has = + isAdmin || + entity.OwnerId == userId; + if (!has) + { + XException.NotAllowed.Throw(); + } // var result = await WebinarProvider .GetSubscriber( webinarId: webinarId, - subscriberId: subscriberId, - requesterUserSelectByParam: requesterId + subscriberId: subscriberId ); // @@ -412,16 +535,33 @@ namespace xWebinarService.Controller try { // - // Retrieve UserInfo ... + // Retrieve User Info ... var userInfo = await GetUserInfo(); - var requesterId = userInfo.UserId; + bool isAdmin = userInfo.Roles.Any(r => r.ToNormalString() == "admin"); + var userId = userInfo.UserId; + + // + // Retrieve Entity ... + var entity = await WebinarProvider.GetWebinar(webinarId); + bool has = !entity.IsNullOrDefault(); + if (!has) + { + XException.NotFound.Throw(); + } + + // + // Check Permissions ... + has = + isAdmin || + entity.OwnerId == userId; + if (!has) + { + XException.NotAllowed.Throw(); + } // var result = await WebinarProvider - .GetSubscribers( - webinarId: webinarId, - requesterUserSelectByParam: requesterId - ); + .GetSubscribers(webinarId); // return Ok(result. @@ -452,16 +592,35 @@ namespace xWebinarService.Controller try { // - // Retrieve UserInfo ... + // Retrieve User Info ... var userInfo = await GetUserInfo(); - var requesterId = userInfo.UserId; + bool isAdmin = userInfo.Roles.Any(r => r.ToNormalString() == "admin"); + var userId = userInfo.UserId; + + // + // Retrieve Entity ... + var entity = await WebinarProvider.GetWebinar(webinarId); + bool has = !entity.IsNullOrDefault(); + if (!has) + { + XException.NotFound.Throw(); + } + + // + // Check Permissions ... + has = + isAdmin || + entity.OwnerId == userId; + if (!has) + { + XException.NotAllowed.Throw(); + } // var result = await WebinarProvider .QuerySubscribers( query: query, - webinarId: webinarId, - requesterUserSelectByParam: requesterId + webinarId: webinarId ); // @@ -476,8 +635,5 @@ namespace xWebinarService.Controller } } #endregion - - // - // Non Actions ... } } \ No newline at end of file diff --git a/Interfaces/IXWebinarProvider.cs b/Interfaces/IXWebinarProvider.cs index e6ea0fb..fa8ce08 100644 --- a/Interfaces/IXWebinarProvider.cs +++ b/Interfaces/IXWebinarProvider.cs @@ -80,12 +80,8 @@ namespace xWebinarService.Interfaces /// Remove Specified Webinar ... /// /// - /// /// - Task RemoveWebinar( - Guid webinarId, - string requesterUserSelectByParam = null - ); + Task RemoveWebinar(Guid webinarId); #endregion // @@ -95,12 +91,10 @@ namespace xWebinarService.Interfaces /// /// /// - /// /// Task Subscribe( Guid webinarId, - string subscriberId, - string requesterUserSelectByParam = null + string subscriberId ); /// @@ -119,12 +113,10 @@ namespace xWebinarService.Interfaces /// /// /// - /// /// Task Unsubscribe( Guid webinarId, - string subscriberId, - string requesterUserSelectByParam = null + string subscriberId ); /// @@ -132,36 +124,28 @@ namespace xWebinarService.Interfaces /// /// /// - /// /// Task GetSubscriber( Guid webinarId, - string subscriberId, - string requesterUserSelectByParam = null + string subscriberId ); /// /// Get all Specified Webinars Subscribers ... /// /// - /// /// - Task> GetSubscribers( - Guid webinarId, - string requesterUserSelectByParam = null - ); + Task> GetSubscribers(Guid webinarId); /// /// Query Specified Webinar's Subscribers ... /// /// /// - /// /// Task> QuerySubscribers( Guid webinarId, - XQuery query, - string requesterUserSelectByParam = null + XQuery query ); #endregion } diff --git a/Providers/XWebinarProvider.cs b/Providers/XWebinarProvider.cs index 8f28278..69f9ebb 100644 --- a/Providers/XWebinarProvider.cs +++ b/Providers/XWebinarProvider.cs @@ -522,11 +522,9 @@ namespace xWebinarService.Providers /// Remove Specified Webinar ... /// /// - /// /// public async Task RemoveWebinar( - Guid webinarId, - string requesterUserSelectByParam = null + Guid webinarId ) { // @@ -551,27 +549,17 @@ namespace xWebinarService.Providers return result; } - // - // Check Permissions ... - result = entity.OwnerId == requesterUserSelectByParam; - if (!result) - { - return result; - } - // // Handle Remove ... var subscribers = await GetSubscribers( - webinarId: webinarId, - requesterUserSelectByParam: requesterUserSelectByParam + webinarId: webinarId ); try { // await subscribers.SelectAsync(async s => await Unsubscribe( webinarId: webinarId, - subscriberId: s.SubscriberId, - requesterUserSelectByParam: requesterUserSelectByParam + subscriberId: s.SubscriberId )); // @@ -600,12 +588,10 @@ namespace xWebinarService.Providers /// /// /// - /// /// public async Task Subscribe( Guid webinarId, - string subscriberId, - string requesterUserSelectByParam = null + string subscriberId ) { // @@ -636,19 +622,7 @@ namespace xWebinarService.Providers // // Check Webinar Enabled ... - result = - webinar.Enabled || - requesterUserSelectByParam == webinar.OwnerId; - if (!result) - { - return result; - } - - // - // Check Webinar Type ... - result = - webinar.Type == XWebinarType.Public || - requesterUserSelectByParam == webinar.OwnerId; + result = webinar.Enabled; if (!result) { return result; @@ -755,12 +729,10 @@ namespace xWebinarService.Providers /// /// /// - /// /// public async Task Unsubscribe( Guid webinarId, - string subscriberId, - string requesterUserSelectByParam = null + string subscriberId ) { // @@ -792,16 +764,6 @@ namespace xWebinarService.Providers // Retrieve Webinar ... var webinar = await WebinarRepository.GetAsync(webinarId); - // - // Check Permission ... - result = - requesterUserSelectByParam == subscriberId || - requesterUserSelectByParam == webinar.OwnerId; - if (!result) - { - return result; - } - // // Retrieve Subscription Entity ... var entity = await WebinarSubscriberRepository.FindOneAsync(ws => @@ -820,12 +782,10 @@ namespace xWebinarService.Providers /// /// /// - /// /// public async Task GetSubscriber( Guid webinarId, - string subscriberId, - string requesterUserSelectByParam = null + string subscriberId ) { // @@ -860,16 +820,6 @@ namespace xWebinarService.Providers XException.NotFound.Throw(); } - // - // Check Permissions ... - isValid = - subscriberId == requesterUserSelectByParam || - webinar.OwnerId == requesterUserSelectByParam; - if (!isValid) - { - XException.NotAllowed.Throw(); - } - // // Converts to Subscriber Dto ... var result = await ToXWebinarSubscriberDto(entity); @@ -880,11 +830,9 @@ namespace xWebinarService.Providers /// Get all Specified Webinars Subscribers ... /// /// - /// /// public async Task> GetSubscribers( - Guid webinarId, - string requesterUserSelectByParam = null + Guid webinarId ) { // @@ -906,15 +854,6 @@ namespace xWebinarService.Providers XException.NotFound.Throw(); } - // - // Check Permissions ... - isValid = - webinar.OwnerId == requesterUserSelectByParam; - if (!isValid) - { - XException.NotAllowed.Throw(); - } - // var subscribers = await WebinarSubscriberRepository.FindManyAsync(e => e.WebinarId == webinarId @@ -934,12 +873,10 @@ namespace xWebinarService.Providers /// /// /// - /// /// public async Task> QuerySubscribers( Guid webinarId, - XQuery query, - string requesterUserSelectByParam = null + XQuery query ) { // @@ -968,8 +905,7 @@ namespace xWebinarService.Providers // // Retrieve all Items ... var items = await GetSubscribers( - webinarId: webinarId, - requesterUserSelectByParam: requesterUserSelectByParam + webinarId: webinarId ); var totalItemsCount = items.Count();