<commit_before>﻿using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Web.Http;
using Core.DomainModel;
using Core.DomainServices;
using Presentation.Web.Models;

namespace Presentation.Web.Controllers.API
{
    public abstract class GenericRightsController<TObject, TRight, TRole> : BaseApiController
        where TObject : HasRightsEntity<TObject, TRight, TRole>
        where TRight : Entity, IRight<TObject, TRight, TRole>
        where TRole : IRoleEntity<TRight>
    {
        protected readonly IGenericRepository<TRight> RightRepository;
        private readonly IGenericRepository<TObject> _objectRepository;

        protected GenericRightsController(IGenericRepository<TRight> rightRepository, IGenericRepository<TObject> objectRepository )
        {
            RightRepository = rightRepository;
            _objectRepository = objectRepository;
        }

        /// <summary>
        /// Returns all rights for an object
        /// </summary>
        /// <param name="id">The id of the object</param>
        /// <returns>List of all rights</returns>
        protected IEnumerable<TRight> GetRightsQuery(int id)
        {
            return RightRepository.Get(right => right.ObjectId == id);
        }

        /// <summary>
        /// Get all rights for a given object
        /// </summary>
        /// <param name="id">The id of the object</param>
        /// <returns>List of rights</returns>
        public virtual HttpResponseMessage GetRights(int id)
        {
            try
            {
                var theRights = GetRightsQuery(id);
                var dtos = Map<IEnumerable<TRight>, IEnumerable<RightOutputDTO>>(theRights);

                return Ok(dtos);
            }
            catch (Exception e)
            {
                return Error(e);
            }
        }

        /// <summary>
        /// Post a new right to the object
        /// </summary>
        /// <param name="id">The id of the object</param>
        /// <param name="organizationId"></param>
        /// <param name="dto">DTO of right</param>
        /// <returns></returns>
        public HttpResponseMessage PostRight(int id, int organizationId, RightInputDTO dto)
        {
            try
            {
                if (!HasWriteAccess(id, KitosUser))
                    return Unauthorized();

                var right = AutoMapper.Mapper.Map<RightInputDTO, TRight>(dto);
                right.ObjectId = id;
                right.ObjectOwner = KitosUser;
                right.LastChangedByUser = KitosUser;
                right.LastChanged = DateTime.Now;

                right = RightRepository.Insert(right);
                RightRepository.Save();

                //TODO: FIX navigation properties not loading properly!!!
                right.User = UserRepository.GetByKey(right.UserId);

                var outputDTO = AutoMapper.Mapper.Map<TRight, RightOutputDTO>(right);

                return Created(outputDTO);
            }
            catch (Exception e)
            {
                return Error(e);
            }
        }

        /// <summary>
        /// Delete a right from the object
        /// </summary>
        /// <param name="id">ID of object</param>
        /// <param name="rId">ID of role</param>
        /// <param name="uId">ID of user in role</param>
        /// <param name="organizationId"></param>
        /// <returns></returns>
        public HttpResponseMessage Delete(int id, [FromUri] int rId, [FromUri] int uId, int organizationId)
        {
            try
            {
                if (!HasWriteAccess(id, KitosUser))
                    return Unauthorized();

                var right = RightRepository.Get(r => r.ObjectId == id && r.RoleId == rId && r.UserId == uId).FirstOrDefault();

                if (right == null) return NotFound();

                RightRepository.DeleteByKey(right.Id);
                RightRepository.Save();

                return Ok();
            }
            catch (Exception e)
            {
                return Error(e);
            }
        }

        private bool HasWriteAccess(int objectId, User user)
        {
            if (user.IsGlobalAdmin)
                return true;

            var obj = _objectRepository.GetByKey(objectId);
            return obj.HasUserWriteAccess(user);
        }
    }
}
<commit_msg>Now checks if user is local admin and within context<commit_after>﻿using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Web.Http;
using Core.DomainModel;
using Core.DomainServices;
using Presentation.Web.Models;

namespace Presentation.Web.Controllers.API
{
    public abstract class GenericRightsController<TObject, TRight, TRole> : BaseApiController
        where TObject : HasRightsEntity<TObject, TRight, TRole>, IContextAware
        where TRight : Entity, IRight<TObject, TRight, TRole>
        where TRole : IRoleEntity<TRight>
    {
        protected readonly IGenericRepository<TRight> RightRepository;
        private readonly IGenericRepository<TObject> _objectRepository;

        protected GenericRightsController(IGenericRepository<TRight> rightRepository, IGenericRepository<TObject> objectRepository )
        {
            RightRepository = rightRepository;
            _objectRepository = objectRepository;
        }

        /// <summary>
        /// Returns all rights for an object
        /// </summary>
        /// <param name="id">The id of the object</param>
        /// <returns>List of all rights</returns>
        protected IEnumerable<TRight> GetRightsQuery(int id)
        {
            return RightRepository.Get(right => right.ObjectId == id);
        }

        /// <summary>
        /// Get all rights for a given object
        /// </summary>
        /// <param name="id">The id of the object</param>
        /// <returns>List of rights</returns>
        public virtual HttpResponseMessage GetRights(int id)
        {
            try
            {
                var theRights = GetRightsQuery(id);
                var dtos = Map<IEnumerable<TRight>, IEnumerable<RightOutputDTO>>(theRights);

                return Ok(dtos);
            }
            catch (Exception e)
            {
                return Error(e);
            }
        }

        /// <summary>
        /// Post a new right to the object
        /// </summary>
        /// <param name="id">The id of the object</param>
        /// <param name="organizationId"></param>
        /// <param name="dto">DTO of right</param>
        /// <returns></returns>
        public HttpResponseMessage PostRight(int id, int organizationId, RightInputDTO dto)
        {
            try
            {
                if (!HasWriteAccess(id, KitosUser, organizationId))
                    return Unauthorized();

                var right = AutoMapper.Mapper.Map<RightInputDTO, TRight>(dto);
                right.ObjectId = id;
                right.ObjectOwner = KitosUser;
                right.LastChangedByUser = KitosUser;
                right.LastChanged = DateTime.Now;

                right = RightRepository.Insert(right);
                RightRepository.Save();

                //TODO: FIX navigation properties not loading properly!!!
                right.User = UserRepository.GetByKey(right.UserId);

                var outputDTO = AutoMapper.Mapper.Map<TRight, RightOutputDTO>(right);

                return Created(outputDTO);
            }
            catch (Exception e)
            {
                return Error(e);
            }
        }

        /// <summary>
        /// Delete a right from the object
        /// </summary>
        /// <param name="id">ID of object</param>
        /// <param name="rId">ID of role</param>
        /// <param name="uId">ID of user in role</param>
        /// <param name="organizationId"></param>
        /// <returns></returns>
        public HttpResponseMessage Delete(int id, [FromUri] int rId, [FromUri] int uId, int organizationId)
        {
            try
            {
                if (!HasWriteAccess(id, KitosUser, organizationId))
                    return Unauthorized();

                var right = RightRepository.Get(r => r.ObjectId == id && r.RoleId == rId && r.UserId == uId).FirstOrDefault();

                if (right == null) return NotFound();

                RightRepository.DeleteByKey(right.Id);
                RightRepository.Save();

                return Ok();
            }
            catch (Exception e)
            {
                return Error(e);
            }
        }

        private bool HasWriteAccess(int objectId, User user, int organizationId)
        {
            if (user.IsGlobalAdmin)
                return true;

            var obj = _objectRepository.GetByKey(objectId);
            // local admin have write access if the obj is in context
            if (obj.IsInContext(organizationId) &&
                user.AdminRights.Any(x => x.ObjectId == organizationId && x.Role.HasWriteAccess))
                return true;

            return obj.HasUserWriteAccess(user);
        }
    }
}

{'fraction_non_alphanumeric': 0.1056946114329435, 'fraction_numerical': 0.0, 'mean_word_length': 1.7199762187871581, 'pattern_counts': {'":': 0, '<': 99, '<?xml version=': 0, '>': 104, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2273585', 'n_tokens_mistral': 2371, 'n_tokens_neox': 2296, 'n_words': 577}