Simple authorization library. NOT Authorize.net.
This is a simple library. Goals are:
- Minimal dependencies.
- Flexible.
- Reasonably simple.
If you do not specify anything, then we are uncertain about authority. Normally, you would ban authorization. But we leave that up to your interpretation. Usually null will be interpretted as false but again, that' s up to you.
UserPermission user = new UserPermission();
bool? canCreate = user.Can(Actions.Create, typeof(AddressModel));
Assert.IsNull(canCreate);
UserPermission user = new UserPermission();
user.AddAuthorization(Actions.Manage);
bool? canCreate = user.Can(Actions.Create, typeof(AddressModel));
Assert.IsTrue(canCreate == true);
canCreate = user.Can(Actions.Delete, typeof(AddressModel));
Assert.IsTrue(canCreate == true);
UserPermission user = new UserPermission();
user.AddAuthorization(Actions.Create);
bool? canCreate = user.Can(Actions.Create, typeof(AddressModel));
Assert.IsTrue(canCreate == true);
UserPermission user = new UserPermission();
user.AddUnauthorization(Actions.Create);
bool? canCreate = user.Can(Actions.Create, typeof(AddressModel));
Assert.IsTrue(canCreate == false);
UserPermission user = new UserPermission();
AddressModel address = new AddressModel();
Update updateAction = new Update(address);
user.AddAuthorization(updateAction);
bool? canUpdate = user.Can(Actions.Update, address);
Assert.IsTrue(canUpdate == true);
// Also cannot update any other instance.
AddressModel differentAddress = new AddressModel();
canUpdate = user.Can(Actions.Update, differentAddress);
Assert.IsTrue(canUpdate == false);
// Nor can they now update any of that type.
canUpdate = user.Can(Actions.Update, typeof(AddressModel));
Assert.IsTrue(canUpdate == false);
As you would expect, unauthorized actions dominate over authorized. The permissions can be serialized to a database.
UserPermission user = new UserPermission();
Create createAction = new Create(typeof(AddressModel));
user.AddAuthorization(createAction);
JsonSerializerSettings settings = new JsonSerializerSettings
{
TypeNameHandling = TypeNameHandling.All,
Formatting = Formatting.Indented
};
string serialized = JsonConvert.SerializeObject(user, settings);
UserPermission deserializedUser = JsonConvert.DeserializeObject<UserPermission>(serialized, settings);
At the moment, there's not really a good way to build an interface on top of this lib since subjects are shoved to objects. You would probably have to build a bunch of type checking to reverse a collection of actions and their subjects out. Also nice to put this into a production project as at this point it's still just a fun little toy.