| | | 1 | | using ArturRios.Util.WebApi.Security.Extensions; |
| | | 2 | | using ArturRios.Util.WebApi.Security.Filters; |
| | | 3 | | using ArturRios.Util.WebApi.Security.Interfaces; |
| | | 4 | | using Microsoft.AspNetCore.Mvc.Filters; |
| | | 5 | | |
| | | 6 | | namespace ArturRios.Util.WebApi.Security.Attributes; |
| | | 7 | | |
| | | 8 | | /// <summary>Rejects requests with a 401 response unless an <see cref="IAuthenticatedUser"/> was attached to the |
| | | 9 | | /// context (typically by <see cref="Security.Middleware.AuthenticationMiddleware"/>), unless the action is marked with |
| | | 10 | | [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)] |
| | | 11 | | public class AuthorizeAttribute : Attribute, IAuthorizationFilter |
| | | 12 | | { |
| | | 13 | | /// <summary>Checks for an authenticated user on the context and short-circuits the pipeline with a 401 result |
| | | 14 | | /// carrying a failed <c>ProcessOutput</c> envelope if none is present.</summary> |
| | | 15 | | /// <param name="context">The authorization filter context for the current request.</param> |
| | | 16 | | public void OnAuthorization(AuthorizationFilterContext context) |
| | | 17 | | { |
| | 4 | 18 | | if (context.ActionDescriptor.AllowsAnonymous() || context.HttpContext.GetUser() is not null) |
| | | 19 | | { |
| | 2 | 20 | | return; |
| | | 21 | | } |
| | | 22 | | |
| | 2 | 23 | | context.Result = AuthorizationResults.Unauthorized(); |
| | 2 | 24 | | } |
| | | 25 | | } |