/// <summary> /// 从cookie中获取UserId /// </summary> /// <param name="cookie"></param> /// <returns></returns> public static LoginClaim GetSessionUser(CookieHeaderValue cookie) { LoginClaim user = new LoginClaim { UserName = "",//匿名用户 Roles = new HashSet <string>() }; if (cookie != null) { var session = cookie[COOKIENAME]; var userCookie = cookie["user"]; if (session != null && !session.Value.Equals("")) { byte[] bytes = Convert.FromBase64String(session.Value); using (MemoryStream ms = new MemoryStream(bytes, 0, bytes.Length)) { ms.Write(bytes, 0, bytes.Length); ms.Position = 0; var obj = new BinaryFormatter().Deserialize(ms); user = (LoginClaim)obj; } } else if (userCookie != null && userCookie.Value.Equals("root")) { user.Roles.Add("Root"); user.UserName = "******"; } } return(user); }
/// <summary> /// 认证,此用户是否对JDBCEntity有某一操作权限 /// </summary> /// <param name="id">节点ID</param> /// <param name="user">发起操作用户</param> /// <param name="operation">操作类型:"421"(4代表读权限,2代表写权限,1代表节点管理权限)</param> /// <returns>Accreditation</returns> public async Task <bool> Authorization(Guid id, LoginClaim user, string operation) { JDBCEntity entity = await myCoreService.GetOneByIdAsync(id); //管理员或所有者直接拥有所有权限,包括根节点 if (IsRootRole(user) || (entity != null && entity.User.Equals(user.UserName))) { return(true); } //entity不存在直接返回false else if (entity == null) { return(false); } //验证某个用户是否拥有对当前节点的某操作权限 else if (entity.GroupPermission.ContainsKey(user.UserName) && entity.GroupPermission[user.UserName].Contains(operation)) { return(true); } //验证某个操作是否属于开放权限 else if (entity.OthersPermission.Contains(operation)) { return(true); } //当权限可继承时,验证某个用户是否拥有对(祖)父节点的某操作权限 else if (entity.QueryToParentPermission) { return(await Authorization(entity.ParentId, user, operation)); } else { return(false); } }
/// <summary> /// 授权,给newuser一个指定权限 /// </summary> /// <param name="id">节点ID</param> /// <param name="user">发起授权用户</param> /// <param name="newuser">被授权用户</param> /// <param name="permisssion">键值对:("group", "1")</param> /// <returns></returns> public async Task AssignPermission(Guid id, LoginClaim user, string newuser, KeyValuePair <string, string> permisssion) { JDBCEntity entity = await myCoreService.GetOneByIdAsync(id); if (entity == null) { throw new Exception(ErrorMessages.EntityNotFoundError); } else if (!user.Equals(entity.User) && !IsRootRole(user)) { throw new Exception(ErrorMessages.WrongUserError); } else //管理员和所有者可进行权限设置 { switch (permisssion.Key.ToLower()) { case "user": //指定所有者 entity.SetUser(newuser); break; case "group": //设置其他用户权限 if (entity.GroupPermission.ContainsKey(newuser)) { entity.GroupPermission[newuser] = permisssion.Value; } else { entity.GroupPermission.Add(newuser, permisssion.Value); } break; case "others": //设置默认用户权限 entity.OthersPermission = permisssion.Value; break; default: throw new Exception(ErrorMessages.NotValidUpdateOperatorError); } await myCoreService.SaveAsync(entity); } }
public bool IsRootRole(LoginClaim user) { return(user.Roles.Contains("Admin") || user.Roles.Contains("Root")); }
/// <summary> /// /// </summary> /// <param name="id"></param> /// <param name="user"></param> /// <param name="operation">read:4,write:2,x:1,operation:"421"</param> /// <returns></returns> public async Task <bool> Authorization(Guid id, LoginClaim user, string operation) { return(await myPermission.Authorization(id, user, operation)); }
public async Task AssignPermission(Guid id, LoginClaim owner, string newuser, KeyValuePair <string, string> permisssion) { await myPermission.AssignPermission(id, owner, newuser, permisssion); }