public async Task updateTopic(Int64 tokenId, Topic Topic) { var token = await quickGetToken(tokenId); var topic = Topic; var originalTopic = await(from t in _context.topics where t.Id == topic.Id select t).FirstOrDefaultAsync(); if (originalTopic == null) { throw AutoApiError.NotFound(); } var role = new UserRole(token.User.RawRole); var canUpdate = (role.IsAdmin || (originalTopic.OwnerId != null && originalTopic.OwnerId.Value == token.UserId)); if (!canUpdate) { throw AutoApiError.Unauthorised(); } originalTopic.Title = topic.Title; originalTopic.RoleToEdit = topic.RoleToEdit; originalTopic.RoleToRead = topic.RoleToRead; _context.topics.Update(originalTopic); await _context.SaveChangesAsync(); }
public async Task logout(Int64 tokenId, string email) { var token = await LoginTokenTasks.GetLoginTokenAsync(_context, tokenId); if (token == null) { throw AutoApiError.NotFound(); } if (email != null) { if (string.IsNullOrWhiteSpace(email)) { throw AutoApiError.InvalidParam("email"); } var userRole = new UserRole(token.User.RawRole); if (!userRole.IsAdmin) { throw AutoApiError.Unauthorised(); } await LoginTokenTasks.LogoutAsync(_context, token, email); } else { await LoginTokenTasks.LogoutAsync(_context, token); } }
public async Task deleteTopic(Int64 tokenId, int topicId) { var token = await quickGetToken(tokenId); var userRole = new UserRole(token.User.RawRole); if (!userRole.IsAdmin) { throw AutoApiError.Unauthorised(); } var topic = await(from t in _context.topics where t.Id == topicId select t).FirstOrDefaultAsync(); if (topic == null) { throw AutoApiError.NotFound(); } topic = null; /* We use this approach because EF Core doesn't support self-referential cascading. */ try { // Delete the topic itself await _context.Database.BeginTransactionAsync(); string sql = "delete from topics where Id = @p0"; int rows = await _context.Database.ExecuteSqlCommandAsync(sql, new object[] { topicId }); // Delete all its children for whom ParentId has now become null, recursively sql = "delete from topics where ParentId is NULL and IsRootEntry = 0"; do { rows = await _context.Database.ExecuteSqlCommandAsync(sql, new object[] { topicId }); } while(rows > 0); // Delete all the posts that have been orphaned as a result of the above. sql = "delete from posts where ParentId is NULL"; do { rows = await _context.Database.ExecuteSqlCommandAsync(sql, new object[] { topicId }); } while(rows > 0); _context.Database.CommitTransaction(); } catch (Exception ex) { Log(ex.Message); _context.Database.RollbackTransaction(); } }
public async Task <Topic> getTopic(Int64 tokenId, int topicId) { var token = await quickGetToken(tokenId, true); Topic topic = await(from t in _context.topics where t.Id == topicId select t).FirstOrDefaultAsync(); if (topic != null) { int tokenRole = token.User.RawRole; if (topic.RoleToRead > tokenRole) { throw AutoApiError.Unauthorised(); } return(topic.CloneForExport()); } throw AutoApiError.NotFound(); }
public async Task <User> getUser(Int64 tokenId, int userId) { var token = await quickGetToken(tokenId); UserRole role = new UserRole(token.User.RawRole); if (!(role.IsAdmin || token.UserId == userId)) { throw AutoApiError.Unauthorised(); } var user = await(from u in _context.users where u.Id == userId select u).FirstOrDefaultAsync(); if (user == null) { throw AutoApiError.NotFound(); } user = user.CloneForExport(); return(user); }
public async Task <Post> getPost(Int64 tokenId, int postId) { var token = await quickGetToken(tokenId); var tokenRole = token.User.RawRole; var post = await(from p in _context.posts where p.Id == postId select p).FirstOrDefaultAsync(); if (tokenRole < post.RoleToRead) { throw AutoApiError.Unauthorised(); } if (post == null) { throw AutoApiError.NotFound(); } return(post.CloneForExport()); }
private async Task <Post> ChangePostAsync(Int64 tokenId, int postId, Action <Post, bool> callback) { var token = await quickGetToken(tokenId); var role = new UserRole(token.User.RawRole); var post = await(from p in _context.posts where p.Id == postId select p).FirstOrDefaultAsync(); if (post == null) { throw AutoApiError.NotFound(); } bool mayChange = (post.UserId != null && post.UserId == token.UserId) || role.IsAdmin; if (!mayChange) { throw AutoApiError.Unauthorised(); } try { callback(post, role.IsAdmin); } catch (Exception ex) { if (ex is AutoApiError) { throw; } throw AutoApiError.ServerError(ex.Message); } post.Modified = DateTime.Now; _context.Update(post); await _context.SaveChangesAsync(); return(post.CloneForExport()); }
public async Task <Post> updatePost(Int64 tokenId, Post Post) { var post = Post; return(await ChangePostAsync(tokenId, post.Id, (originalPost, isAdmin) => { if ((originalPost.RoleToEdit != post.RoleToEdit || originalPost.RoleToRead != post.RoleToRead) && !isAdmin) { throw AutoApiError.NotFound(); } else { originalPost.RoleToEdit = post.RoleToEdit; originalPost.RoleToEdit = post.RoleToRead; } originalPost.Title = post.Title; originalPost.Body = post.Body; originalPost.Modified = DateTime.UtcNow; })); }
public async Task <Topic> createTopic(Int64 tokenId, int?parentTopicId, string title, int roleToEdit, int roleToRead) { var token = await quickGetToken(tokenId); var userRole = new UserRole(token.User.RawRole); if (parentTopicId == null) //Only administators can edit the root topic level. { if (!userRole.IsAdmin) { throw AutoApiError.Unauthorised(); } } else { var parentTopic = await(from t in _context.topics where t.Id == parentTopicId.Value select t).FirstOrDefaultAsync(); if (parentTopic == null) { throw AutoApiError.NotFound(); } if (parentTopic.RoleToEdit > token.User.RawRole) { throw AutoApiError.Unauthorised(); } } if (title == null) { throw AutoApiError.InvalidParam("title."); } if (!UserRole.RoleIsValid(roleToEdit)) { throw AutoApiError.InvalidRole("roleToEdit."); } if (!UserRole.RoleIsValid(roleToRead)) { throw AutoApiError.InvalidParam("roleToRead."); } if (roleToRead > token.User.RawRole) { throw new AutoApiError("The topic would be unreadable by its creator."); } var topic = new Topic(); topic.Title = title; topic.RoleToEdit = roleToEdit; topic.RoleToRead = roleToRead; topic.ParentId = parentTopicId; topic.IsRootEntry = parentTopicId == null; topic.OwnerId = token.UserId; var now = DateTime.UtcNow; topic.Modified = now; topic.Created = now; _context.topics.Add(topic); await _context.SaveChangesAsync(); return(topic.CloneForExport()); }