/// <summary>
/// Policies are looked up by string name, so expect 'parameters' to be encoded (embedded) in the policy names (errr-don't blame me).
/// </summary>
/// <param name="encodedPolicyName">A colon ':' delimited string of three values [<see cref="RightType>"/>:<see cref="Permission"/>:<see cref="string"/>]</param>
/// <remarks>
/// For Encoding and Decoding see <see cref="PolicyName"/>
/// </remarks>
public Task <AuthorizationPolicy> GetPolicyAsync(string encodedPolicyName)
{
// here's the other end of the magic to decode the string with the requirement details
var requirementDetails = PolicyName.Deserialise(encodedPolicyName);
// If the policy name doesn't match the format expected by this policy provider,
// try the fallback provider. If no fallback provider is used, this would return
// Task.FromResult<AuthorizationPolicy>(null) instead.
if (requirementDetails == null)
{
return(FallbackPolicyProvider.GetPolicyAsync(encodedPolicyName));
}
var policy = new AuthorizationPolicyBuilder();
policy.RequireAuthenticatedUser();
// Set multiple bearer tokens. This pairs with .AddAuthententication to expose
// multiple www-authenticate headers on a 401
//
// see https://stackoverflow.com/questions/49694383/use-multiple-jwt-bearer-authentication
//
policy.AuthenticationSchemes.Add(AuthenticatorDefaults.ExternalAuthenticationSchemeName);
// now we can hand in the requirements from the attribute into the policy which what we really want to do
policy.AddRequirements(
new HasPermissionsOnResourceRequirement(
requirementDetails.Type,
requirementDetails.Access,
requirementDetails.ResourceKey));
return(Task.FromResult(policy.Build()));
}
public AuthoriseAttribute(
RightType type,
Permission permission = Permission.None,
string resourceKey = ResourceKey.Id)
{
// here's the magic of a delimited string
Policy = PolicyName.Make(type, permission, resourceKey).Serialise();
}