diff --git a/backend/src/Equinor.ProjectExecutionPortal.WebApi/Authorization/Extensions/RequirementBuilderExtensions.cs b/backend/src/Equinor.ProjectExecutionPortal.WebApi/Authorization/Extensions/RequirementBuilderExtensions.cs deleted file mode 100644 index baf16e8b..00000000 --- a/backend/src/Equinor.ProjectExecutionPortal.WebApi/Authorization/Extensions/RequirementBuilderExtensions.cs +++ /dev/null @@ -1,33 +0,0 @@ -using Equinor.ProjectExecutionPortal.WebApi.Authorization.Requirements; -using Fusion.AspNetCore.FluentAuthorization; -using Microsoft.AspNetCore.Authorization; - -namespace Equinor.ProjectExecutionPortal.WebApi.Authorization.Extensions; - -public static class ApplicationsRequirementBuilderExtensions -{ - public static IAuthorizationRequirementRule HasPortalsFullControl(this IAuthorizationRequirementRule builder) - { - builder.OrGlobalRole(Scopes.ProjectPortalAdmin); - - return builder; - } - - public static IAuthorizationRequirementRule BePortalAdmin(this IAuthorizationRequirementRule builder, Guid portalId) - { - builder.AddRule(portalId, new PortalAdminRequirement()); - - return builder; - } - - private static IAuthorizationRequirementRule OrGlobalRole(this IAuthorizationRequirementRule builder, params string[] scopes) - { - var policy = new AuthorizationPolicyBuilder() - .RequireAssertion(c => scopes.Any(role => c.User.IsInRole(role))) - .Build(); - - builder.AddRule((auth, user) => auth.AuthorizeAsync(user, policy)); - - return builder; - } -} diff --git a/backend/src/Equinor.ProjectExecutionPortal.WebApi/Authorization/Requirements/PortalAdminRequirement.cs b/backend/src/Equinor.ProjectExecutionPortal.WebApi/Authorization/Requirements/PortalAdminRequirement.cs deleted file mode 100644 index ce64d388..00000000 --- a/backend/src/Equinor.ProjectExecutionPortal.WebApi/Authorization/Requirements/PortalAdminRequirement.cs +++ /dev/null @@ -1,45 +0,0 @@ -using Equinor.ProjectExecutionPortal.Application.Services.PortalService; -using Fusion; -using Fusion.Authorization; -using Microsoft.AspNetCore.Authorization; - -namespace Equinor.ProjectExecutionPortal.WebApi.Authorization.Requirements; - -public class PortalAdminRequirement : FusionAuthorizationRequirement -{ - public override string Description => "User must be either a portal admin or global admin"; - public override string Code => "PortalAdmins"; - - public class Handler : AuthorizationHandler - { - private readonly IPortalService _portalService; - - public Handler(IPortalService portalService) - { - _portalService = portalService; - } - - protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, PortalAdminRequirement requirement, Guid portalId) - { - var userOId = context.User.GetAzureUniqueIdOrThrow(); - - var isGlobalAdmin = context.User.IsInRole(Scopes.ProjectPortalAdmin); - - if (isGlobalAdmin) - { - context.Succeed(requirement); - } - - var isPortalAdmin = await _portalService.UserIsAdmin(portalId, userOId); - - if (isPortalAdmin) - { - context.Succeed(requirement); - } - else - { - requirement.SetEvaluation("User is not portal owner"); - } - } - } -} diff --git a/backend/src/Equinor.ProjectExecutionPortal.WebApi/Controllers/ProfileController.cs b/backend/src/Equinor.ProjectExecutionPortal.WebApi/Controllers/ProfileController.cs deleted file mode 100644 index e27d4e41..00000000 --- a/backend/src/Equinor.ProjectExecutionPortal.WebApi/Controllers/ProfileController.cs +++ /dev/null @@ -1,32 +0,0 @@ -using Equinor.ProjectExecutionPortal.WebApi.Authorization.Extensions; -using Fusion.AspNetCore.FluentAuthorization; -using Microsoft.AspNetCore.Mvc; - -namespace Equinor.ProjectExecutionPortal.WebApi.Controllers; - -[ApiVersion("1.0")] -[Route("api/profile")] -public class ProfileController : ApiControllerBase -{ - [HttpOptions("admin")] - [ProducesResponseType(StatusCodes.Status200OK)] - [ProducesResponseType(StatusCodes.Status403Forbidden)] - public async Task Options() - { - #region Authorization - - var authResult = await Request.RequireAuthorizationAsync(builder => - { - builder.AlwaysAccessWhen().HasPortalsFullControl(); - }); - - if (authResult.Unauthorized) - { - return authResult.CreateForbiddenResponse(); - } - - #endregion - - return Ok(); - } -} diff --git a/backend/src/Equinor.ProjectExecutionPortal.WebApi/DiModules/ApplicationModule.cs b/backend/src/Equinor.ProjectExecutionPortal.WebApi/DiModules/ApplicationModule.cs index 430d1403..9ce5c7c5 100644 --- a/backend/src/Equinor.ProjectExecutionPortal.WebApi/DiModules/ApplicationModule.cs +++ b/backend/src/Equinor.ProjectExecutionPortal.WebApi/DiModules/ApplicationModule.cs @@ -60,7 +60,6 @@ public static void AddApplicationModules(this IServiceCollection services, IConf services.AddScoped(); // Authorization handlers - services.AddScoped(); services.AddScoped(); } }