public async Task <ActionResult <IEnumerable <EnrolmentStatus> > > GetEnrolmentStatuses(int enrolleeId) { var record = await _enrolleeService.GetPermissionsRecordAsync(enrolleeId); if (record == null) { return(NotFound(ApiResponse.Message($"Enrollee not found with id {enrolleeId}"))); } if (!record.ViewableBy(User)) { return(Forbid()); } var enrollees = await _enrolleeService.GetEnrolmentStatusesAsync(enrolleeId); return(Ok(ApiResponse.Result(enrollees))); }
public async Task <ActionResult <IEnumerable <EnrolmentStatus> > > GetEnrolmentStatuses(int enrolleeId) { var enrollee = await _enrolleeService.GetEnrolleeAsync(enrolleeId); if (enrollee == null) { return(NotFound(ApiResponse.Message($"Enrollee not found with id {enrolleeId}"))); } if (!User.CanView(enrollee)) { return(Forbid()); } var enrollees = await _enrolleeService.GetEnrolmentStatusesAsync(enrolleeId); return(Ok(ApiResponse.Result(enrollees))); }
public async Task <ActionResult <IEnumerable <EnrolmentStatus> > > GetEnrolmentStatuses(int enrolleeId) { var enrollee = await _enrolleeService.GetEnrolleeAsync(enrolleeId); if (enrollee == null) { return(NotFound(new ApiResponse(404, $"Enrollee not found with id {enrolleeId}"))); } // if the user is not an ADMIN, make sure the enrolleeId matches the user, otherwise return not authorized if (!BelongsToEnrollee(enrollee)) { return(Forbid()); } var enrollees = await _enrolleeService.GetEnrolmentStatusesAsync(enrolleeId); return(Ok(new ApiOkResponse <IEnumerable <EnrolmentStatus> >(enrollees))); }