| | | 1 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 2 | | using ArturRios.Heimdall.Domain.Enums; |
| | | 3 | | using ArturRios.Heimdall.Shared.Services; |
| | | 4 | | |
| | | 5 | | namespace ArturRios.Heimdall.Command.Services; |
| | | 6 | | |
| | | 7 | | /// <summary> |
| | | 8 | | /// Who may have an account email sent to whom (UC-51, UC-52, AF-51b/AF-52b): a System Admin to any |
| | | 9 | | /// person; a Scope Admin only to a <c>User</c> of a scope they own. Shared by both use cases so they |
| | | 10 | | /// cannot drift apart. |
| | | 11 | | /// </summary> |
| | | 12 | | public static class PersonEmailAuthorization |
| | | 13 | | { |
| | | 14 | | /// <summary> |
| | | 15 | | /// Whether the actor may act on <paramref name="person" />. A Scope Admin aiming at anyone but a |
| | | 16 | | /// <c>User</c> is refused without a database read; for a <c>User</c>, ownership of |
| | | 17 | | /// <c>Person.ScopeId</c> is asked of <paramref name="scopeOwnership" />. |
| | | 18 | | /// </summary> |
| | | 19 | | public static async Task<bool> ActorMayEmailAsync( |
| | | 20 | | IScopeOwnershipChecker scopeOwnership, int actingRole, Guid actingPersonId, Person person) |
| | | 21 | | { |
| | 47 | 22 | | if (actingRole == (int)Roles.SystemAdmin) |
| | | 23 | | { |
| | 35 | 24 | | return true; |
| | | 25 | | } |
| | | 26 | | |
| | 12 | 27 | | if (actingRole != (int)Roles.ScopeAdmin |
| | 12 | 28 | | || person.RoleId != (long)Roles.User |
| | 12 | 29 | | || person.ScopeId is not { } scopeId) |
| | | 30 | | { |
| | 3 | 31 | | return false; |
| | | 32 | | } |
| | | 33 | | |
| | 9 | 34 | | return await scopeOwnership.ActorMayManageScopeAsync(actingRole, actingPersonId, scopeId); |
| | 47 | 35 | | } |
| | | 36 | | } |