admin/marco.pms.api
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Enhancement #381: Update "Update Bucket" API to Enforce Feature

Browse Source
This commit is contained in:
ashutosh.nehete 2025-05-27 12:37:24 +05:30
parent f7d90b85e8
commit c1cc8d5d34
2 changed files with 32 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Marco.Pms.Services/Controllers/DirectoryController.cs
View File

@ -284,6 +284,10 @@ namespace Marco.Pms.Services.Controllers
{
return NotFound(response);
}
else if (response.StatusCode == 401)
{
return Unauthorized(response);
}
else
{
return BadRequest(response);

29
Marco.Pms.Services/Helpers/DirectoryHelper.cs
View File

@ -1108,12 +1108,39 @@ namespace Marco.Pms.Services.Helpers
var LoggedInEmployee = await _userHelper.GetCurrentEmployeeAsync();
if (bucketDto != null && id == bucketDto.Id)
{
var bucket = await _context.Buckets.FirstOrDefaultAsync(b => b.Id == bucketDto.Id && b.TenantId == tenantId);
var assignedRoleIds = await _context.EmployeeRoleMappings.Where(r => r.EmployeeId == LoggedInEmployee.Id).Select(r => r.RoleId).ToListAsync();
var permissionIds = await _context.RolePermissionMappings.Where(rp => assignedRoleIds.Contains(rp.ApplicationRoleId)).Select(rp => rp.FeaturePermissionId).Distinct().ToListAsync();
var bucketIds = await _context.EmployeeBucketMappings.Where(eb => eb.EmployeeId == LoggedInEmployee.Id).Select(eb => eb.BucketId).ToListAsync();
Bucket? bucket = await _context.Buckets.FirstOrDefaultAsync(b => b.Id == bucketDto.Id && b.TenantId == tenantId);
if (bucket == null)
{
_logger.LogWarning("Employee ID {LoggedInEmployeeId} attempted to update a bucket but not found in database.", LoggedInEmployee.Id);
return ApiResponse<object>.ErrorResponse("Bucket not found", "Bucket not found", 404);
}
Bucket? accessableBucket = null;
if (permissionIds.Contains(directoryAdmin))
{
accessableBucket = bucket;
}
else if (permissionIds.Contains(directoryManager) && bucketIds.Contains(id))
{
accessableBucket = bucket;
}
else if (permissionIds.Contains(directoryUser))
{
if (bucket.CreatedByID == LoggedInEmployee.Id)
{
accessableBucket = bucket;
}
}
if (accessableBucket == null)
{
_logger.LogError("Employee {EmployeeId} attempted to access bucket {BucketId} without the necessary permissions.", LoggedInEmployee.Id, bucket.Id);
return ApiResponse<object>.ErrorResponse("You don't have permission to access this bucket", "You don't have permission to access this bucket", 401);
}
bucket.Name = bucketDto.Name ?? "";
bucket.Description = bucketDto.Description ?? "";