init

KretaWeb/Areas/MobileApi/Attributes/MobileApiAuthorizationAttribute.cs

@@ -0,0 +1,175 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net.Http.Headers;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Web;
+using System.Web.Http.Controllers;
+using System.Web.Http.Filters;
+using Kreta.BusinessLogic.Classes.MobileApi.Common.Co;
+using Kreta.BusinessLogic.Classes.MobileApi.Common.Enum;
+using Kreta.Web.Configuration;
+
+namespace Kreta.Web.Areas.MobileApi.Attributes
+{
+    // <summary>
+    /// Authorization filter attribute
+    /// </summary>
+    /// <seealso cref="System.Web.Http.Filters.AuthorizationFilterAttribute" />
+    class MobileApiAuthorizationAttribute : AuthorizationFilterAttribute, IOverrideFilter
+    {
+        /// <summary>
+        /// Institute code
+        /// </summary>
+        const string InstituteCode = nameof(InstituteCode);
+
+        /// <summary>
+        /// Gets the API key.
+        /// </summary>
+        const string ApiKey = nameof(ApiKey);
+
+        /// <summary>
+        /// User Id
+        /// </summary>
+        const string UserId = nameof(UserId);
+
+        /// <summary>
+        /// Tutelary Id
+        /// </summary>
+        const string TutelaryId = nameof(TutelaryId);
+
+        /// <summary>
+        /// User roles
+        /// </summary>
+        const string UserRoles = nameof(UserRoles);
+
+        const string SchoolYearId = nameof(SchoolYearId);
+
+        /// <summary>
+        /// Gets the filters to override.
+        /// </summary>
+        public Type FiltersToOverride
+        {
+            get
+            {
+                return typeof(IAuthorizationFilter);
+            }
+        }
+
+        /// <summary>
+        /// Validating api key
+        /// </summary>
+        /// <param name="apiKeyHeader">Header item, contains api key</param>
+        /// <returns>true, if api key is valid (access granted)</returns>
+        private bool AccessGratnedByApiKey(KeyValuePair<string, IEnumerable<string>> apiKeyHeader)
+        {
+            if (apiKeyHeader.Value != null)
+            {
+                string targetApiKey = apiKeyHeader.Value.SingleOrDefault();
+
+                if (!string.IsNullOrWhiteSpace(targetApiKey) && targetApiKey == MobileApiConfigurationSection.Instance.ApiKey)
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
+        /// <summary>
+        /// Get mobile user
+        /// </summary>
+        /// <param name="headers">Http headers</param>
+        /// <returns>Mobile user</returns>
+        private MobileUser GetMobileUser(HttpRequestHeaders headers)
+        {
+            var instituteCodeHeaderValue = headers.SingleOrDefault(x => x.Key.Equals(InstituteCode, StringComparison.InvariantCultureIgnoreCase)).Value?.SingleOrDefault();
+
+            var schoolYearIdHeaderValue = headers.SingleOrDefault(x => x.Key.Equals(SchoolYearId, StringComparison.InvariantCultureIgnoreCase)).Value?.SingleOrDefault();
+            int schoolYearId;
+
+            int userId;
+            var userIdHeaderValue = headers.SingleOrDefault(x => x.Key.Equals(UserId, StringComparison.InvariantCultureIgnoreCase)).Value?.SingleOrDefault();
+
+            if (userIdHeaderValue == null)
+            {
+                throw new InvalidOperationException($"\"{UserId}\" header value was not found");
+            }
+
+            if (!int.TryParse(userIdHeaderValue, out userId))
+            {
+                throw new InvalidOperationException($"Cannot parse \"{UserId}\" header value: \"{userIdHeaderValue}\"");
+            }
+
+            if (schoolYearIdHeaderValue == null)
+            {
+                throw new InvalidOperationException($"\"{SchoolYearId}\" header value was not found");
+            }
+
+            if (!int.TryParse(schoolYearIdHeaderValue, out schoolYearId))
+            {
+                throw new InvalidOperationException($"Cannot parse \"{SchoolYearId}\" header value: \"{schoolYearIdHeaderValue}\"");
+            }
+
+            int? tutelaryId = null;
+            var tutelaryIdHeaderValue = headers.SingleOrDefault(x => x.Key.Equals(TutelaryId, StringComparison.InvariantCultureIgnoreCase)).Value?.SingleOrDefault() ?? string.Empty;
+
+            if (tutelaryIdHeaderValue == null)
+            {
+                throw new InvalidOperationException($"\"{TutelaryId}\" header value was not found");
+            }
+
+            if (!string.IsNullOrWhiteSpace(tutelaryIdHeaderValue.Trim()))
+            {
+                int tutelaryId1;
+                if (!int.TryParse(tutelaryIdHeaderValue, out tutelaryId1))
+                {
+                    throw new InvalidOperationException($"Cannot parse \"{TutelaryId}\" header value: \"{tutelaryIdHeaderValue}\"");
+                }
+                tutelaryId = tutelaryId1;
+            }
+
+            var userRolesHeaderValue = headers.SingleOrDefault(x => x.Key.Equals(UserRoles, StringComparison.InvariantCultureIgnoreCase)).Value?.SingleOrDefault();
+
+            if (userRolesHeaderValue == null)
+            {
+                throw new InvalidOperationException($"\"{UserRoles}\" header value was not found");
+            }
+
+            List<MobileUserRole> userRoles = new List<MobileUserRole>();
+            foreach (string userRoleHeaderValue in userRolesHeaderValue.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
+            {
+                MobileUserRole userRole;
+                if (!Enum.TryParse(userRoleHeaderValue, out userRole))
+                {
+                    throw new InvalidOperationException($"\"{userRoleHeaderValue}\" is not a valid user role");
+                }
+                userRoles.Add(userRole);
+            }
+
+            return new MobileUser(instituteCodeHeaderValue, userId, tutelaryId, userRoles, schoolYearId);
+        }
+
+        /// <summary>
+        /// Authorization event
+        /// </summary>
+        /// <param name="actionContext">Context of the current action</param>
+        /// <param name="cancellationToken">Cancellation token</param>
+        public override Task OnAuthorizationAsync(HttpActionContext actionContext, CancellationToken cancellationToken)
+        {
+            var headers = actionContext.Request.Headers;
+
+            var apiKeyHeader = headers.SingleOrDefault(x => x.Key.Equals(ApiKey, StringComparison.InvariantCultureIgnoreCase));
+
+            if (!AccessGratnedByApiKey(apiKeyHeader))
+            {
+                actionContext.Response = new System.Net.Http.HttpResponseMessage(System.Net.HttpStatusCode.Unauthorized);
+            }
+
+            HttpContext.Current?.Items?.Add(nameof(MobileUser), GetMobileUser(headers));
+
+            return Task.FromResult(0);
+        }
+    }
+}