public async Task updateTopic(Int64 tokenId, Topic Topic)
{
var token = await quickGetToken(tokenId);
var topic = Topic;
var originalTopic = await(from t in _context.topics
where t.Id == topic.Id
select t).FirstOrDefaultAsync();
if (originalTopic == null)
{
throw AutoApiError.NotFound();
}
var role = new UserRole(token.User.RawRole);
var canUpdate = (role.IsAdmin || (originalTopic.OwnerId != null && originalTopic.OwnerId.Value == token.UserId));
if (!canUpdate)
{
throw AutoApiError.Unauthorised();
}
originalTopic.Title = topic.Title;
originalTopic.RoleToEdit = topic.RoleToEdit;
originalTopic.RoleToRead = topic.RoleToRead;
_context.topics.Update(originalTopic);
await _context.SaveChangesAsync();
}
public async Task logout(Int64 tokenId, string email)
{
var token = await LoginTokenTasks.GetLoginTokenAsync(_context, tokenId);
if (token == null)
{
throw AutoApiError.NotFound();
}
if (email != null)
{
if (string.IsNullOrWhiteSpace(email))
{
throw AutoApiError.InvalidParam("email");
}
var userRole = new UserRole(token.User.RawRole);
if (!userRole.IsAdmin)
{
throw AutoApiError.Unauthorised();
}
await LoginTokenTasks.LogoutAsync(_context, token, email);
}
else
{
await LoginTokenTasks.LogoutAsync(_context, token);
}
}
public async Task deleteTopic(Int64 tokenId, int topicId)
{
var token = await quickGetToken(tokenId);
var userRole = new UserRole(token.User.RawRole);
if (!userRole.IsAdmin)
{
throw AutoApiError.Unauthorised();
}
var topic = await(from t in _context.topics
where t.Id == topicId
select t).FirstOrDefaultAsync();
if (topic == null)
{
throw AutoApiError.NotFound();
}
topic = null;
/* We use this approach because EF Core doesn't support self-referential cascading. */
try
{
// Delete the topic itself
await _context.Database.BeginTransactionAsync();
string sql = "delete from topics where Id = @p0";
int rows = await _context.Database.ExecuteSqlCommandAsync(sql, new object[] { topicId });
// Delete all its children for whom ParentId has now become null, recursively
sql = "delete from topics where ParentId is NULL and IsRootEntry = 0";
do
{
rows = await _context.Database.ExecuteSqlCommandAsync(sql, new object[] { topicId });
} while(rows > 0);
// Delete all the posts that have been orphaned as a result of the above.
sql = "delete from posts where ParentId is NULL";
do
{
rows = await _context.Database.ExecuteSqlCommandAsync(sql, new object[] { topicId });
} while(rows > 0);
_context.Database.CommitTransaction();
}
catch (Exception ex)
{
Log(ex.Message);
_context.Database.RollbackTransaction();
}
}
public async Task <Topic> getTopic(Int64 tokenId, int topicId)
{
var token = await quickGetToken(tokenId, true);
Topic topic = await(from t in _context.topics
where t.Id == topicId
select t).FirstOrDefaultAsync();
if (topic != null)
{
int tokenRole = token.User.RawRole;
if (topic.RoleToRead > tokenRole)
{
throw AutoApiError.Unauthorised();
}
return(topic.CloneForExport());
}
throw AutoApiError.NotFound();
}
public async Task <User> getUser(Int64 tokenId, int userId)
{
var token = await quickGetToken(tokenId);
UserRole role = new UserRole(token.User.RawRole);
if (!(role.IsAdmin || token.UserId == userId))
{
throw AutoApiError.Unauthorised();
}
var user = await(from u in _context.users where u.Id == userId select u).FirstOrDefaultAsync();
if (user == null)
{
throw AutoApiError.NotFound();
}
user = user.CloneForExport();
return(user);
}
public async Task <Post> getPost(Int64 tokenId, int postId)
{
var token = await quickGetToken(tokenId);
var tokenRole = token.User.RawRole;
var post = await(from p in _context.posts
where p.Id == postId
select p).FirstOrDefaultAsync();
if (tokenRole < post.RoleToRead)
{
throw AutoApiError.Unauthorised();
}
if (post == null)
{
throw AutoApiError.NotFound();
}
return(post.CloneForExport());
}
private async Task <Post> ChangePostAsync(Int64 tokenId, int postId, Action <Post, bool> callback)
{
var token = await quickGetToken(tokenId);
var role = new UserRole(token.User.RawRole);
var post = await(from p in _context.posts
where p.Id == postId
select p).FirstOrDefaultAsync();
if (post == null)
{
throw AutoApiError.NotFound();
}
bool mayChange = (post.UserId != null && post.UserId == token.UserId) ||
role.IsAdmin;
if (!mayChange)
{
throw AutoApiError.Unauthorised();
}
try
{
callback(post, role.IsAdmin);
}
catch (Exception ex)
{
if (ex is AutoApiError)
{
throw;
}
throw AutoApiError.ServerError(ex.Message);
}
post.Modified = DateTime.Now;
_context.Update(post);
await _context.SaveChangesAsync();
return(post.CloneForExport());
}
public async Task <Post> updatePost(Int64 tokenId, Post Post)
{
var post = Post;
return(await ChangePostAsync(tokenId, post.Id,
(originalPost, isAdmin) =>
{
if ((originalPost.RoleToEdit != post.RoleToEdit ||
originalPost.RoleToRead != post.RoleToRead) &&
!isAdmin)
{
throw AutoApiError.NotFound();
}
else
{
originalPost.RoleToEdit = post.RoleToEdit;
originalPost.RoleToEdit = post.RoleToRead;
}
originalPost.Title = post.Title;
originalPost.Body = post.Body;
originalPost.Modified = DateTime.UtcNow;
}));
}
public async Task <Topic> createTopic(Int64 tokenId, int?parentTopicId, string title, int roleToEdit, int roleToRead)
{
var token = await quickGetToken(tokenId);
var userRole = new UserRole(token.User.RawRole);
if (parentTopicId == null) //Only administators can edit the root topic level.
{
if (!userRole.IsAdmin)
{
throw AutoApiError.Unauthorised();
}
}
else
{
var parentTopic = await(from t in _context.topics
where t.Id == parentTopicId.Value
select t).FirstOrDefaultAsync();
if (parentTopic == null)
{
throw AutoApiError.NotFound();
}
if (parentTopic.RoleToEdit > token.User.RawRole)
{
throw AutoApiError.Unauthorised();
}
}
if (title == null)
{
throw AutoApiError.InvalidParam("title.");
}
if (!UserRole.RoleIsValid(roleToEdit))
{
throw AutoApiError.InvalidRole("roleToEdit.");
}
if (!UserRole.RoleIsValid(roleToRead))
{
throw AutoApiError.InvalidParam("roleToRead.");
}
if (roleToRead > token.User.RawRole)
{
throw new AutoApiError("The topic would be unreadable by its creator.");
}
var topic = new Topic();
topic.Title = title;
topic.RoleToEdit = roleToEdit;
topic.RoleToRead = roleToRead;
topic.ParentId = parentTopicId;
topic.IsRootEntry = parentTopicId == null;
topic.OwnerId = token.UserId;
var now = DateTime.UtcNow;
topic.Modified = now;
topic.Created = now;
_context.topics.Add(topic);
await _context.SaveChangesAsync();
return(topic.CloneForExport());
}