internal IEnumerable <Dictionary <string, object> > GetItems(IInstanceContext context, string contentType, IBlock ctxBlock, string appPath = null) { var wrapLog = Log.Call($"get entities type:{contentType}, path:{appPath}"); // if app-path specified, use that app, otherwise use from context var appIdentity = AppFinder.GetAppIdFromPathOrContext(appPath, ctxBlock); // get the app - if we have the context from the request, use that, otherwise generate full app var app = ctxBlock == null ? Factory.Resolve <Apps.App>().Init(appIdentity, Log) : GetApp(appIdentity.AppId, ctxBlock); // verify that read-access to these content-types is permitted var permCheck = new MultiPermissionsTypes().Init(context, app, contentType, Log); if (!permCheck.EnsureAll(GrantSets.ReadSomething, out var error)) { throw HttpException.PermissionDenied(error); } var result = new EntityApi(appIdentity.AppId, permCheck.EnsureAny(GrantSets.ReadDraft), Log) .GetEntities(contentType) ?.ToList(); wrapLog("found: " + result?.Count); return(result); }
/// <summary> /// Preprocess security / context, then get the item based on an passed in method, /// ...then process/finish /// </summary> /// <returns></returns> internal Dictionary <string, object> GetOne(IInstanceContext context, IBlock ctxBlock, string contentType, Func <EntityApi, IEntity> getOne, string appPath) { Log.Add($"get and serialize after security check type:{contentType}, path:{appPath}"); // if app-path specified, use that app, otherwise use from context var appIdentity = AppFinder.GetAppIdFromPathOrContext(appPath, ctxBlock); var entityApi = new EntityApi(appIdentity.AppId, true, Log); var itm = getOne(entityApi); var permCheck = new MultiPermissionsItems().Init(context, GetApp(appIdentity.AppId, ctxBlock), itm, Log); if (!permCheck.EnsureAll(GrantSets.ReadSomething, out var error)) { throw HttpException.PermissionDenied(error); } // in case draft wasn't allow, get again with more restricted permissions if (!permCheck.EnsureAny(GrantSets.ReadDraft)) { entityApi = new EntityApi(appIdentity.AppId, false, Log); itm = getOne(entityApi); } return(InitEavAndSerializer(appIdentity.AppId, ctxBlock?.EditAllowed ?? false).Convert(itm)); }
[AllowAnonymous] // will check security internally, so assume no requirements public IEnumerable <Dictionary <string, object> > GetEntities(string contentType, string appPath = null, string cultureCode = null) { var wraplog = Log.Call($"get entities type:{contentType}, path:{appPath}, culture:{cultureCode}"); // if app-path specified, use that app, otherwise use from context var appIdentity = AppFinder.GetAppIdFromPathOrContext(appPath, BlockBuilder); // verify that read-access to these content-types is permitted var permCheck = new MultiPermissionsTypes(BlockBuilder, appIdentity.AppId, contentType, Log); if (!permCheck.EnsureAll(GrantSets.ReadSomething, out var exp)) { throw exp; } //2018-09-15 2dm replaced //var context = GetContext(SxcBlock, Log); //PerformSecurityCheck(appIdentity, contentType, Grants.Read, appPath == null ? context.Dnn.Module : null); var result = new EntityApi(appIdentity.AppId, permCheck.EnsureAny(GrantSets.ReadDraft), Log) .GetEntities(contentType, cultureCode) ?.ToList(); wraplog("found: " + result?.Count); return(result); }
/// <summary> /// Preprocess security / context, then get the item based on an passed in method, /// ...then process/finish /// </summary> /// <param name="contentType"></param> /// <param name="getOne"></param> /// <param name="appPath"></param> /// <returns></returns> private Dictionary <string, object> GetAndSerializeOneAfterSecurityChecks(string contentType, Func <EntityApi, IEntity> getOne, string appPath) { Log.Add($"get and serialie after security check type:{contentType}, path:{appPath}"); // if app-path specified, use that app, otherwise use from context var appIdentity = AppFinder.GetAppIdFromPathOrContext(appPath, BlockBuilder); var entityApi = new EntityApi(appIdentity.AppId, true, Log); var itm = getOne(entityApi); var permCheck = new MultiPermissionsItems(BlockBuilder, appIdentity.AppId, itm, Log); if (!permCheck.EnsureAll(GrantSets.ReadSomething, out var exception)) { throw exception; } // in case draft wasn't allow, get again with more restricted permissions if (!permCheck.EnsureAny(GrantSets.ReadDraft)) { entityApi = new EntityApi(appIdentity.AppId, false, Log); itm = getOne(entityApi); } return(InitEavAndSerializer(appIdentity.AppId).Convert(itm)); }
[AllowAnonymous] // will check security internally, so assume no requirements public Dictionary <string, object> CreateOrUpdate([FromUri] string contentType, [FromBody] Dictionary <string, object> newContentItem, [FromUri] int?id = null, [FromUri] string appPath = null) { Log.Add($"create or update type:{contentType}, id:{id}, path:{appPath}"); // if app-path specified, use that app, otherwise use from context var appIdentity = AppFinder.GetAppIdFromPathOrContext(appPath, SxcInstance); // Check that this ID is actually of this content-type, // this throws an error if it's not the correct type var itm = id == null ? null : new EntityApi(appIdentity.AppId, Log).GetOrThrow(contentType, id.Value); var ok = itm == null ? new MultiPermissionsTypes(SxcInstance, appIdentity.AppId, contentType, Log) .EnsureAll(Grants.Create.AsSet(), out var exp) : new MultiPermissionsItems(SxcInstance, appIdentity.AppId, itm, Log) .EnsureAll(Grants.Update.AsSet(), out exp); if (!ok) { throw exp; } //2018-09-15 2dm moved/disabled //var context = GetContext(SxcInstance, Log); //PerformSecurityCheck(appIdentity, contentType, perm, appPath == null ? context.Dnn.Module : null, itm); // Convert to case-insensitive dictionary just to be safe! newContentItem = new Dictionary <string, object>(newContentItem, StringComparer.OrdinalIgnoreCase); // Now create the cleaned up import-dictionary so we can create a new entity var cleanedNewItem = new AppContentEntityBuilder(Log) .CreateEntityDictionary(contentType, newContentItem, appIdentity.AppId); var userName = new DnnUser().IdentityToken; // try to create var publish = Factory.Resolve <IEnvironmentFactory>().PagePublisher(Log); // 2018-09-22 new // todo: something looks wrong here, I think create/update would fail if it doesn't have a moduleid var currentApp = new App(new DnnTenant(PortalSettings), appIdentity.ZoneId, appIdentity.AppId, ConfigurationProvider.Build(false, publish.IsEnabled(ActiveModule.ModuleID), SxcInstance.Data.ConfigurationProvider), true, Log); // 2018-09-22 old //currentApp.InitData(false, // publish.IsEnabled(ActiveModule.ModuleID), // SxcInstance.Data.ConfigurationProvider); if (id == null) { currentApp.Data.Create(contentType, cleanedNewItem, userName); // Todo: try to return the newly created object return(null); } currentApp.Data.Update(id.Value, cleanedNewItem, userName); return(InitEavAndSerializer(appIdentity.AppId).Prepare(currentApp.Data.List.One(id.Value))); }
internal Dictionary <string, object> CreateOrUpdate(IInstanceContext context, IBlock ctxBlock, string contentType, Dictionary <string, object> newContentItem, int?id = null, string appPath = null) { Log.Add($"create or update type:{contentType}, id:{id}, path:{appPath}"); // if app-path specified, use that app, otherwise use from context var appIdentity = AppFinder.GetAppIdFromPathOrContext(appPath, ctxBlock); // Check that this ID is actually of this content-type, // this throws an error if it's not the correct type var itm = id == null ? null : new EntityApi(appIdentity.AppId, true, Log).GetOrThrow(contentType, id.Value); var ok = itm == null ? new MultiPermissionsTypes() .Init(context, GetApp(appIdentity.AppId, ctxBlock), contentType, Log) .EnsureAll(Grants.Create.AsSet(), out var error) : new MultiPermissionsItems().Init(context, GetApp(appIdentity.AppId, ctxBlock), itm, Log) .EnsureAll(Grants.Update.AsSet(), out error); if (!ok) { throw HttpException.PermissionDenied(error); } // Convert to case-insensitive dictionary just to be safe! newContentItem = new Dictionary <string, object>(newContentItem, StringComparer.OrdinalIgnoreCase); // Now create the cleaned up import-dictionary so we can create a new entity var cleanedNewItem = new AppContentEntityBuilder(Log) .CreateEntityDictionary(contentType, newContentItem, appIdentity.AppId); var userName = context.User.IdentityToken; // try to create // 2020-08-21 disabled publish check, don't think it's relevant in API mode // var publish = Factory.Resolve<IPagePublishing>().Init(Log); // var enablePublish = publish.IsEnabled(context.Container.Id); var currentApp = GetApp(appIdentity.AppId, ctxBlock); //Factory.Resolve<Apps.App>().Init(appIdentity, // ConfigurationProvider.Build(false, false, // ctxBlockBuilder?.Block.Data.Configuration.LookUps), true, Log); if (id == null) { var entity = currentApp.Data.Create(contentType, cleanedNewItem, userName); id = entity.EntityId; } else { currentApp.Data.Update(id.Value, cleanedNewItem, userName); } return(InitEavAndSerializer(appIdentity.AppId, ctxBlock?.EditAllowed ?? false) .Convert(currentApp.Data.List.One(id.Value))); }
internal void Delete(IInstanceContext context, IBlock ctxBlock, string contentType, Guid guid, string appPath) { Log.Add($"delete guid:{guid}, type:{contentType}, path:{appPath}"); // if app-path specified, use that app, otherwise use from context var appIdentity = AppFinder.GetAppIdFromPathOrContext(appPath, ctxBlock); var entityApi = new EntityApi(appIdentity.AppId, true, Log); var itm = entityApi.GetOrThrow(contentType == "any" ? null : contentType, guid); var permCheck = new MultiPermissionsItems().Init(context, GetApp(appIdentity.AppId, ctxBlock), itm, Log); if (!permCheck.EnsureAll(Grants.Delete.AsSet(), out var error)) { throw HttpException.PermissionDenied(error); } entityApi.Delete(itm.Type.Name, guid); }
[AllowAnonymous] // will check security internally, so assume no requirements public void Delete(string contentType, Guid guid, [FromUri] string appPath = null) { Log.Add($"delete guid:{guid}, type:{contentType}, path:{appPath}"); // if app-path specified, use that app, otherwise use from context var appIdentity = AppFinder.GetAppIdFromPathOrContext(appPath, BlockBuilder); var entityApi = new EntityApi(appIdentity.AppId, true, Log); var itm = entityApi.GetOrThrow(contentType == "any" ? null : contentType, guid); var permCheck = new MultiPermissionsItems(BlockBuilder, appIdentity.AppId, itm, Log); if (!permCheck.EnsureAll(Grants.Delete.AsSet(), out var exception)) { throw exception; } entityApi.Delete(itm.Type.Name, guid); }
/// <summary> /// Preprocess security / context, then get the item based on an passed in method, /// ...then process/finish /// </summary> /// <param name="contentType"></param> /// <param name="getOne"></param> /// <param name="appPath"></param> /// <returns></returns> private Dictionary <string, object> GetAndSerializeOneAfterSecurityChecks(string contentType, Func <int, IEntity> getOne, string appPath) { Log.Add($"get and serialie after security check type:{contentType}, path:{appPath}"); // if app-path specified, use that app, otherwise use from context var appIdentity = AppFinder.GetAppIdFromPathOrContext(appPath, SxcInstance); var itm = getOne(appIdentity.AppId); var permCheck = new MultiPermissionsItems(SxcInstance, appIdentity.AppId, itm, Log); if (!permCheck.EnsureAll(GrantSets.ReadSomething, out var exception)) { throw exception; } //2018-09-15 2dm moved/disabled //var context = GetContext(SxcInstance, Log); //PerformSecurityCheck(appIdentity, contentType, Grants.Read, appPath == null ? context.Dnn.Module : null, itm); return(InitEavAndSerializer(appIdentity.AppId).Prepare(itm)); }
[AllowAnonymous] // will check security internally, so assume no requirements public void Delete(string contentType, Guid guid, [FromUri] string appPath = null) { Log.Add($"delete guid:{guid}, type:{contentType}, path:{appPath}"); // if app-path specified, use that app, otherwise use from context var appIdentity = AppFinder.GetAppIdFromPathOrContext(appPath, SxcInstance); var entityApi = new EntityApi(appIdentity.AppId, Log); var itm = entityApi.GetOrThrow(contentType == "any" ? null : contentType, guid); var permCheck = new MultiPermissionsItems(SxcInstance, appIdentity.AppId, itm, Log); if (!permCheck.EnsureAll(Grants.Delete.AsSet(), out var exception)) { throw exception; } //2018-09-15 2dm moved/disabled //var context = GetContext(SxcInstance, Log); //PerformSecurityCheck(appIdentity, itm.Type.Name, Grants.Delete, appPath == null ? context.Dnn.Module : null, itm); entityApi.Delete(itm.Type.Name, guid); }