Wsrtjtyk

I have API with asp.net core 2.1. Claims-based authentication. Is it possible to combine these two api function in one?

[Authorize(Roles = "Admin")]

[HttpPost("delete")]

public IActionResult Delete([FromBody]Item item)

{

    _itemService.Delete(item.Id);

    return Ok();

}



[Authorize]

[HttpPost("delete")]

public IActionResult Delete([FromBody]Item item)

{

    var id = int.Parse(User.FindFirst(ClaimTypes.NameIdentifier).Value);

    if (_itemService.IsAuthor(id))

    {

        _itemService.Delete(item.Id);

        return Ok();

    }

    return Forbid();

}

Or should I just check the role inside method?

For checking the permission with whether the user is Admin or Author, you could implement multiple requirements as the doc from @user2884707bond.

For using the multiple requrements for your scenario.

You could follow steps below:

• 
  

  PermissionHandler.cs

  
  
  

          public class PermissionHandler : IAuthorizationHandler
  
  {
  
      public Task HandleAsync(AuthorizationHandlerContext context)
  
      {
  
          var pendingRequirements = context.PendingRequirements.ToList();
  
  
  
          foreach (var requirement in pendingRequirements)
  
          {
  
              if (requirement is ReadPermission)
  
              {
  
                  if (IsOwner(context.User, context.Resource) ||
  
                      IsAdmin(context.User, context.Resource))
  
                  {
  
                      context.Succeed(requirement);
  
                  }
  
              }
  
              else if (requirement is EditPermission ||
  
                       requirement is DeletePermission)
  
              {
  
                  if (IsOwner(context.User, context.Resource))
  
                  {
  
                      context.Succeed(requirement);
  
                  }
  
              }
  
          }
  
          return Task.CompletedTask;
  
      }
  
      private bool IsAdmin(ClaimsPrincipal user, object resource)
  
      {
  
          if (user.IsInRole("Admin"))
  
          {
  
              return true;
  
          }
  
          return false;
  
      }
  
  
  
      private bool IsOwner(ClaimsPrincipal user, object resource)
  
      {
  
          // Code omitted for brevity
  
  
  
          return true;
  
      }
  
  
  
      private bool IsSponsor(ClaimsPrincipal user, object resource)
  
      {
  
          // Code omitted for brevity
  
  
  
          return true;
  
      }
  
  }
  
  

  
  


• 
  

  Requirements

  
  
  

      public class ReadPermission : IAuthorizationRequirement
  
  {
  
      // Code omitted for brevity
  
  }
  
  public class EditPermission : IAuthorizationRequirement
  
  {
  
      // Code omitted for brevity
  
  }
  
  public class DeletePermission : IAuthorizationRequirement
  
  {
  
      // Code omitted for brevity
  
  }
  
  

  
  


• 
  

  Register Requirement in Startup.cs

  
  
  

          services.AddAuthorization(options =>
  
      {
  
          options.AddPolicy("Read", policy => policy.AddRequirements(new ReadPermission()));                
  
      });
  
      services.AddSingleton<IAuthorizationHandler, PermissionHandler>();
  
  

  
  


• 
  

  Use

  
  
  

   [Authorize(Policy = "Read")]
  
   [HttpPost("delete")]
  
   public IActionResult Delete([FromBody]Item item)
  
   {
  
        _itemService.Delete(item.Id);
  
        return Ok();
  
    }