46 lines
2.0 KiB
C#
46 lines
2.0 KiB
C#
using PostFundManagement.Application.Abstractions.Services;
|
|
using static PostFundManagement.Application.Extensions.General;
|
|
using static PostFundManagement.Domain.Extensions.Constants;
|
|
|
|
namespace PostFundManagement.Application.Filters;
|
|
|
|
public sealed class ActiveUserFilter(IIdentityService identityService) : IEndpointFilter
|
|
{
|
|
public async ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
|
|
{
|
|
var principal = context.HttpContext.User;
|
|
|
|
if (principal.Identity is null || !principal.Identity.IsAuthenticated)
|
|
return Results.Unauthorized();
|
|
|
|
var (decoded, userId) = principal.GetUserId();
|
|
var (emailDecoded, email) = principal.GetUserEmail();
|
|
var (roleDecoded, role) = principal.GetUserRole();
|
|
|
|
if (!decoded)
|
|
return Results.Json(new { message = "Invalid user identifier in token." }, statusCode: StatusCodes.Status401Unauthorized);
|
|
|
|
if (!emailDecoded)
|
|
return Results.Json(new { message = "Invalid/missing user email in token." }, statusCode: StatusCodes.Status401Unauthorized);
|
|
|
|
if (!roleDecoded)
|
|
return Results.Json(new { message = "Invalid/missing user role in token." }, statusCode: StatusCodes.Status401Unauthorized);
|
|
|
|
var path = context.HttpContext.Request.Path.Value;
|
|
|
|
if (!string.IsNullOrWhiteSpace(path) && !path!.EndsWith("integration/sync", StringComparison.InvariantCultureIgnoreCase))
|
|
{
|
|
var userAuthResult = await identityService.UserIsAuthorisedAsync(userId, context.HttpContext.RequestAborted);
|
|
|
|
if (userAuthResult.IsFailed)
|
|
return Results.Json(new { message = "Account approval is pending or inactive." }, statusCode: StatusCodes.Status403Forbidden);
|
|
}
|
|
|
|
context.HttpContext.Items[UserIdItemKey] = userId;
|
|
context.HttpContext.Items[EmailtemKey] = email;
|
|
context.HttpContext.Items[UserRoleItemKey] = role;
|
|
|
|
return await next(context);
|
|
}
|
|
}
|