Add team roles and content management updates

2026-06-25 19:52:46 +02:00
parent 54293f4c45
commit 693769e5a8
126 changed files with 6966 additions and 738 deletions
@@ -1,5 +1,6 @@
 using Backend.Domain;
 using Backend.Security;
+using Backend.Data;

 namespace Backend.Endpoints;

@@ -7,4 +8,54 @@ internal static class AdminEndpointConventions
 {
    public static UserSession CurrentSession(HttpContext context) =>
        context.GetCurrentSession() ?? throw new InvalidOperationException("Admin session missing from request context.");
+
+    public static async ValueTask<object?> RequirePermission(
+        EndpointFilterInvocationContext context,
+        EndpointFilterDelegate next,
+        string permissionKey)
+    {
+        var session = CurrentSession(context.HttpContext);
+        var db = context.HttpContext.RequestServices.GetRequiredService<AwardsDbContext>();
+        if (!await AdminPermissionCatalog.HasPermissionAsync(db, session.Role, permissionKey, context.HttpContext.RequestAborted))
+        {
+            return Results.Json(
+                new { message = $"Diese Admin-Aktion braucht die Berechtigung '{permissionKey}'." },
+                statusCode: StatusCodes.Status403Forbidden);
+        }
+
+        return await next(context);
+    }
+
+    public static async ValueTask<object?> RequireWritePermission(
+        EndpointFilterInvocationContext context,
+        EndpointFilterDelegate next,
+        string permissionKey)
+    {
+        var session = CurrentSession(context.HttpContext);
+        if (AdminRoles.Normalize(session.Role) == AdminRoles.OrganizationTeam)
+        {
+            return Results.Json(
+                new { message = "Organisation Team hat fuer diesen Bereich nur Leserechte." },
+                statusCode: StatusCodes.Status403Forbidden);
+        }
+
+        return await RequirePermission(context, next, permissionKey);
+    }
+
+    public static async ValueTask<object?> RequireAnyPermission(
+        EndpointFilterInvocationContext context,
+        EndpointFilterDelegate next,
+        string[] permissionKeys)
+    {
+        var session = CurrentSession(context.HttpContext);
+        var db = context.HttpContext.RequestServices.GetRequiredService<AwardsDbContext>();
+        if (!await AdminPermissionCatalog.HasAnyPermissionAsync(db, session.Role, permissionKeys, context.HttpContext.RequestAborted))
+        {
+            return Results.Json(
+                new { message = "Diese Admin-Aktion braucht eine passende Rollenberechtigung." },
+                statusCode: StatusCodes.Status403Forbidden);
+        }
+
+        return await next(context);
+    }
 }