60 lines
2.5 KiB
C#
60 lines
2.5 KiB
C#
using System.Text.Json;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Authorization.Policy;
|
|
using Tiku.Application.Security;
|
|
using Tiku.Domain.Operations;
|
|
using Tiku.Infrastructure.Persistence;
|
|
|
|
namespace Tiku.Api.Security;
|
|
|
|
internal sealed class AuditingAuthorizationMiddlewareResultHandler(
|
|
IServiceScopeFactory scopeFactory,
|
|
ILogger<AuditingAuthorizationMiddlewareResultHandler> logger) : IAuthorizationMiddlewareResultHandler
|
|
{
|
|
private readonly AuthorizationMiddlewareResultHandler fallback = new();
|
|
|
|
public async Task HandleAsync(
|
|
RequestDelegate next,
|
|
HttpContext context,
|
|
AuthorizationPolicy policy,
|
|
PolicyAuthorizationResult authorizeResult)
|
|
{
|
|
if (authorizeResult.Forbidden && context.User.Identity?.IsAuthenticated == true)
|
|
{
|
|
try
|
|
{
|
|
await using var scope = scopeFactory.CreateAsyncScope();
|
|
var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
|
|
dbContext.AuditLogs.Add(new AuditLog
|
|
{
|
|
TenantId = Guid.TryParse(context.User.FindFirst(TikuClaimTypes.TenantId)?.Value, out var tenantId)
|
|
? tenantId
|
|
: null,
|
|
ActorUserId = Guid.TryParse(context.User.FindFirst(TikuClaimTypes.UserId)?.Value, out var userId)
|
|
? userId
|
|
: null,
|
|
Action = "authorization.access_denied",
|
|
TargetType = "http_endpoint",
|
|
TargetId = context.Request.Path,
|
|
IpAddress = context.Connection.RemoteIpAddress?.ToString(),
|
|
UserAgent = context.Request.Headers.UserAgent.ToString(),
|
|
Details = JsonSerializer.SerializeToElement(new
|
|
{
|
|
Method = context.Request.Method,
|
|
Path = context.Request.Path.Value,
|
|
Realm = context.User.FindFirst(TikuClaimTypes.Realm)?.Value,
|
|
Failure = authorizeResult.AuthorizationFailure?.FailureReasons.Select(reason => reason.Message).ToArray()
|
|
})
|
|
});
|
|
await dbContext.SaveChangesAsync(context.RequestAborted);
|
|
}
|
|
catch (Exception exception)
|
|
{
|
|
logger.LogWarning(exception, "Failed to persist authorization denial audit event.");
|
|
}
|
|
}
|
|
|
|
await fallback.HandleAsync(next, context, policy, authorizeResult);
|
|
}
|
|
}
|