From 33fd4f24428736bb85d9502470fd92cb09f95cd5 Mon Sep 17 00:00:00 2001
From: Hamid Reza Mohammadi <mohammadi.hr@gmail.com>
Date: Sat, 31 Oct 2020 19:25:15 +0330
Subject: [PATCH] #25 default policy

---
 RMuseum/Startup.cs                            |  7 +++++
 .../UserGroupPermissionHandler.cs             | 28 +++++++++++++++++--
 RSecurityBackend/RSecurityBackend.xml         |  8 +++++-
 3 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/RMuseum/Startup.cs b/RMuseum/Startup.cs
index 30b55d25..8e57af40 100644
--- a/RMuseum/Startup.cs
+++ b/RMuseum/Startup.cs
@@ -154,6 +154,13 @@ namespace RMuseum
 
             services.AddAuthorization(options =>
             {
+                //this is the default policy to make sure the use session has not yet been deleted by him/her from another client
+                //or by an addmin (Authorize with no policy should fail on deleted sessions)
+                var defPolicy = new AuthorizationPolicyBuilder();
+                defPolicy.Requirements.Add(new UserGroupPermissionRequirement("null", "null"));
+                options.DefaultPolicy = defPolicy.Build();
+
+
                 foreach (SecurableItem Item in RMuseumSecurableItem.Items)
                 {
                     foreach (SecurableItemOperation Operation in Item.Operations)
diff --git a/RSecurityBackend/Authorization/UserGroupPermissionHandler.cs b/RSecurityBackend/Authorization/UserGroupPermissionHandler.cs
index 9b8d453a..35c1d5ed 100644
--- a/RSecurityBackend/Authorization/UserGroupPermissionHandler.cs
+++ b/RSecurityBackend/Authorization/UserGroupPermissionHandler.cs
@@ -27,6 +27,21 @@ namespace RSecurityBackend.Authorization
                 return;
             }
 
+            //this is the default policy to make sure the use session has not yet been deleted by him/her from another client
+            //or by an addmin (Authorize with no policy should fail on deleted sessions)
+            if (requirement.SecurableItemShortName == "null"/* && requirement.OperationShortName == "null"*/)
+            {
+                RServiceResult<bool> sessionCheckResult = await _appUserService.SessionExists(new Guid(context.User.Claims.FirstOrDefault(c => c.Type == "UserId").Value), new Guid(context.User.Claims.FirstOrDefault(c => c.Type == "SessionId").Value));
+                if (!string.IsNullOrEmpty(sessionCheckResult.ExceptionString) || !sessionCheckResult.Result)
+                {
+                    context.Fail();
+                    return;
+                }
+
+                context.Succeed(requirement);
+                return;
+            }
+
             RServiceResult<bool> result = await _userPermissionChecker.Check
                 (
                 new Guid(context.User.Claims.FirstOrDefault(c => c.Type == "UserId").Value),
@@ -51,14 +66,21 @@ namespace RSecurityBackend.Authorization
         /// </summary>
         private IUserPermissionChecker _userPermissionChecker;
 
-              
+        /// <summary>
+        /// IAppUserService instance
+        /// </summary>
+        protected IAppUserService _appUserService;
+
+
         /// <summary>
         /// constructor
         /// </summary>
         /// <param name="userPermissionChecker"></param>
-        public UserGroupPermissionHandler(IUserPermissionChecker userPermissionChecker) : base()
+        /// <param name="appUserService"></param>
+        public UserGroupPermissionHandler(IUserPermissionChecker userPermissionChecker, IAppUserService appUserService) : base()
         {
-            _userPermissionChecker = userPermissionChecker;         
+            _userPermissionChecker = userPermissionChecker;
+            _appUserService = appUserService;
         }
     }
 }
diff --git a/RSecurityBackend/RSecurityBackend.xml b/RSecurityBackend/RSecurityBackend.xml
index 00a512cd..d2c20fda 100644
--- a/RSecurityBackend/RSecurityBackend.xml
+++ b/RSecurityBackend/RSecurityBackend.xml
@@ -22,11 +22,17 @@
             IUserPermissionChecker instance
             </summary>
         </member>
-        <member name="M:RSecurityBackend.Authorization.UserGroupPermissionHandler.#ctor(RSecurityBackend.Services.IUserPermissionChecker)">
+        <member name="F:RSecurityBackend.Authorization.UserGroupPermissionHandler._appUserService">
+            <summary>
+            IAppUserService instance
+            </summary>
+        </member>
+        <member name="M:RSecurityBackend.Authorization.UserGroupPermissionHandler.#ctor(RSecurityBackend.Services.IUserPermissionChecker,RSecurityBackend.Services.IAppUserService)">
             <summary>
             constructor
             </summary>
             <param name="userPermissionChecker"></param>
+            <param name="appUserService"></param>
         </member>
         <member name="T:RSecurityBackend.Authorization.UserGroupPermissionRequirement">
             <summary>