32 lines
984 B
C#
32 lines
984 B
C#
using System.Security.Claims;
|
|
using Tiku.Application.Security;
|
|
using Tiku.Domain.Tenancy;
|
|
using ZLinq;
|
|
|
|
namespace Tiku.Api.Security;
|
|
|
|
internal static class TenantRoleAuthorization
|
|
{
|
|
private static readonly HashSet<string> AdminRoles = new(StringComparer.Ordinal)
|
|
{
|
|
nameof(TenantRole.PlatformAdmin),
|
|
nameof(TenantRole.TenantOwner),
|
|
nameof(TenantRole.TenantAdmin)
|
|
};
|
|
|
|
public static bool IsTenantMember(ClaimsPrincipal principal)
|
|
{
|
|
return principal.Identity?.IsAuthenticated == true &&
|
|
principal.HasClaim(claim => claim.Type == TikuClaimTypes.TenantId);
|
|
}
|
|
|
|
public static bool IsTenantAdmin(ClaimsPrincipal principal)
|
|
{
|
|
return IsTenantMember(principal) &&
|
|
principal.Claims.AsValueEnumerable()
|
|
.Where(claim => claim.Type == TikuClaimTypes.TenantRole)
|
|
.Select(claim => claim.Value)
|
|
.Any(role => AdminRoles.Contains(role));
|
|
}
|
|
}
|