//******************************************************************************************************//  RoleBasedSecurityAttribute.cs - Gbtc////  Copyright © 2016, Grid Protection Alliance.  All Rights Reserved.////  Licensed to the Grid Protection Alliance (GPA) under one or more contributor license agreements. See//  the NOTICE file distributed with this work for additional information regarding copyright ownership.//  The GPA licenses this file to you under the MIT License (MIT), the "License"; you may not use this//  file except in compliance with the License. You may obtain a copy of the License at:////      http://opensource.org/licenses/MIT////  Unless agreed to in writing, the subject software distributed under the License is distributed on an//  "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Refer to the//  License for the specific language governing permissions and limitations.////  Code Modification History://  ----------------------------------------------------------------------------------------------------//  02/23/2016 - J. Ritchie Carroll//       Generated original version of source code.////****************************************************************************************************** using System;using System.Linq;using System.Security;using System.Threading;using System.Web.Mvc;using GSF.Collections;using GSF.Data;using GSF.Identity;using GSF.Security; namespace GSF.Web.Security{    /// <summary>    /// Defines an MVC filter attribute to handle the GSF role based security model.    /// </summary>    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = false)]    public class AuthorizeControllerRoleAttribute : FilterAttribute, IAuthorizationFilter, IExceptionFilter    {        #region [ Members ]         // Fields         /// <summary>        /// Gets allowed roles as a string array.        /// </summary>        public readonly string[] AllowedRoles;         #endregion         #region [ Constructors ]         /// <summary>        /// Creates a new MVC based authorization attribute.        /// </summary>        public AuthorizeControllerRoleAttribute()        {            AllowedRoles = new string[0];            SettingsCategory = "securityProvider";            SecurityExceptionViewName = "SecurityError";        }         /// <summary>        /// Creates a new MVC based authorization attribute for specified roles.        /// </summary>        public AuthorizeControllerRoleAttribute(string allowedRoles)        {            AllowedRoles = allowedRoles?.Split(',').Select(role => role.Trim()).                Where(role => !string.IsNullOrEmpty(role)).ToArray() ?? new string[0];             SettingsCategory = "securityProvider";            SecurityExceptionViewName = "SecurityError";        }         #endregion         #region [ Properties ]         /// <summary>        /// Gets or sets settings category to use for loading data context for security info.        /// </summary>        public string SettingsCategory        {            get; set;        }         /// <summary>        /// Gets or sets view name to show for security exceptions.        /// </summary>        public string SecurityExceptionViewName        {            get; set;        }         #endregion         #region [ Methods ]         /// <summary>        /// Called when authorization is required.        /// </summary>        /// <param name="filterContext">The filter context.</param>        public void OnAuthorization(AuthorizationContext filterContext)        {            SecurityProviderCache.ValidateCurrentProvider();             // Setup the principal            filterContext.HttpContext.User = Thread.CurrentPrincipal;             // Get current user name            string userName = Thread.CurrentPrincipal.Identity.Name;             // Verify that the current thread principal has been authenticated.            if (!Thread.CurrentPrincipal.Identity.IsAuthenticated)                throw new SecurityException($"Authentication failed for user '{userName}': {SecurityProviderCache.CurrentProvider.AuthenticationFailureReason}");             if (AllowedRoles.Length > 0 && !AllowedRoles.Any(role => filterContext.HttpContext.User.IsInRole(role)))                throw new SecurityException($"Access is denied for user '{userName}': minimum required roles = {AllowedRoles.ToDelimitedString(", ")}.");             // Make sure current user ID is cached            if (!AuthorizationCache.UserIDs.ContainsKey(userName))            {                using (AdoDataConnection connection = new AdoDataConnection(SettingsCategory))                {                    AuthorizationCache.UserIDs.TryAdd(userName, connection.ExecuteScalar<Guid?>("SELECT ID FROM UserAccount WHERE Name={0}", UserInfo.UserNameToSID(userName)) ?? Guid.Empty);                }            }        }         /// <summary>        /// Called when an exception occurs.        /// </summary>        /// <param name="filterContext">The filter context.</param>        public void OnException(ExceptionContext filterContext)        {            if (filterContext.Exception is SecurityException)            {                filterContext.Result = new ViewResult                {                    ViewName = SecurityExceptionViewName,                    ViewData = new ViewDataDictionary                    {                        ["Exception"] = filterContext.Exception                    }                };                filterContext.ExceptionHandled = true;            }        }         #endregion    }}