430 lines
15 KiB
C#
430 lines
15 KiB
C#
using System.Linq;
|
|
using System.Threading.Tasks;
|
|
using Microsoft.AspNetCore.Http;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.AspNetCore.Routing;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.JsonPatch;
|
|
using Microsoft.EntityFrameworkCore;
|
|
using Microsoft.Extensions.Logging;
|
|
|
|
using AyaNova.Models;
|
|
using AyaNova.Api.ControllerHelpers;
|
|
using AyaNova.Biz;
|
|
|
|
|
|
namespace AyaNova.Api.Controllers
|
|
{
|
|
|
|
/// <summary>
|
|
/// User
|
|
/// </summary>
|
|
[ApiVersion("8.0")]
|
|
[Route("api/v{version:apiVersion}/[controller]")]
|
|
[Produces("application/json")]
|
|
[Authorize]
|
|
public class UserController : Controller
|
|
{
|
|
private readonly AyContext ct;
|
|
private readonly ILogger<UserController> log;
|
|
private readonly ApiServerState serverState;
|
|
|
|
|
|
/// <summary>
|
|
/// ctor
|
|
/// </summary>
|
|
/// <param name="dbcontext"></param>
|
|
/// <param name="logger"></param>
|
|
/// <param name="apiServerState"></param>
|
|
public UserController(AyContext dbcontext, ILogger<UserController> logger, ApiServerState apiServerState)
|
|
{
|
|
ct = dbcontext;
|
|
log = logger;
|
|
serverState = apiServerState;
|
|
}
|
|
|
|
|
|
|
|
|
|
/// <summary>
|
|
/// Get User
|
|
///
|
|
/// Required roles:
|
|
/// BizAdminFull, BizAdminLimited
|
|
/// </summary>
|
|
/// <param name="id"></param>
|
|
/// <returns>A single User</returns>
|
|
[HttpGet("{id}")]
|
|
public async Task<IActionResult> GetUser([FromRoute] long id)
|
|
{
|
|
if (serverState.IsClosed)
|
|
{
|
|
return StatusCode(503, new ApiErrorResponse(ApiErrorCode.API_CLOSED, null, serverState.Reason));
|
|
}
|
|
|
|
if (!Authorized.IsAuthorizedToReadFullRecord(HttpContext.Items, AyaType.User))
|
|
{
|
|
return StatusCode(401, new ApiNotAuthorizedResponse());
|
|
}
|
|
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return BadRequest(new ApiErrorResponse(ModelState));
|
|
}
|
|
|
|
//Instantiate the business object handler
|
|
UserBiz biz = new UserBiz(ct, UserIdFromContext.Id(HttpContext.Items), UserRolesFromContext.Roles(HttpContext.Items));
|
|
|
|
var o = await biz.GetAsync(id);
|
|
|
|
if (o == null)
|
|
{
|
|
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
|
|
}
|
|
|
|
//Log
|
|
EventLogProcessor.AddEntry(new Event(biz.userId, o.Id, AyaType.User, AyaEvent.Retrieved), ct);
|
|
ct.SaveChanges();
|
|
return Ok(new ApiOkResponse(o));
|
|
}
|
|
|
|
|
|
|
|
/// <summary>
|
|
/// Get paged list of Users
|
|
///
|
|
/// Required roles:
|
|
/// BizAdminFull, BizAdminLimited
|
|
///
|
|
/// </summary>
|
|
/// <returns>Paged collection of Users with paging data</returns>
|
|
[HttpGet("ListUsers", Name = nameof(ListUsers))]//We MUST have a "Name" defined or we can't get the link for the pagination, non paged urls don't need a name
|
|
public async Task<IActionResult> ListUsers([FromQuery] PagingOptions pagingOptions)
|
|
{
|
|
|
|
if (serverState.IsClosed)
|
|
{
|
|
return StatusCode(503, new ApiErrorResponse(ApiErrorCode.API_CLOSED, null, serverState.Reason));
|
|
}
|
|
|
|
if (!Authorized.IsAuthorizedToReadFullRecord(HttpContext.Items, AyaType.User))
|
|
{
|
|
return StatusCode(401, new ApiNotAuthorizedResponse());
|
|
}
|
|
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return BadRequest(new ApiErrorResponse(ModelState));
|
|
}
|
|
|
|
//Instantiate the business object handler
|
|
UserBiz biz = new UserBiz(ct, UserIdFromContext.Id(HttpContext.Items), UserRolesFromContext.Roles(HttpContext.Items));
|
|
|
|
ApiPagedResponse<System.Object> pr = await biz.GetManyAsync(Url, nameof(ListUsers), pagingOptions);
|
|
return Ok(new ApiOkWithPagingResponse<System.Object>(pr));
|
|
}
|
|
|
|
|
|
|
|
/// <summary>
|
|
/// Get User pick list
|
|
///
|
|
/// Required roles: Any
|
|
///
|
|
/// This list supports querying the Name property
|
|
/// include a "q" parameter for string to search for
|
|
/// use % for wildcards.
|
|
///
|
|
/// e.g. q=%ohn%
|
|
///
|
|
/// Query is case insensitive
|
|
/// </summary>
|
|
/// <returns>Paged id/name collection of Users with paging data</returns>
|
|
[HttpGet("PickList", Name = nameof(UserPickList))]
|
|
public async Task<IActionResult> UserPickList([FromQuery] string q, [FromQuery] PagingOptions pagingOptions)
|
|
{
|
|
if (serverState.IsClosed)
|
|
{
|
|
return StatusCode(503, new ApiErrorResponse(ApiErrorCode.API_CLOSED, null, serverState.Reason));
|
|
}
|
|
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return BadRequest(new ApiErrorResponse(ModelState));
|
|
}
|
|
|
|
//Instantiate the business object handler
|
|
UserBiz biz = new UserBiz(ct, UserIdFromContext.Id(HttpContext.Items), UserRolesFromContext.Roles(HttpContext.Items));
|
|
|
|
ApiPagedResponse<NameIdItem> pr = await biz.GetPickListAsync(Url, nameof(UserPickList), pagingOptions, q);
|
|
return Ok(new ApiOkWithPagingResponse<NameIdItem>(pr));
|
|
}
|
|
|
|
|
|
/// <summary>
|
|
/// Put (update) User
|
|
///
|
|
/// Required roles:
|
|
/// BizAdminFull
|
|
///
|
|
/// </summary>
|
|
/// <param name="id"></param>
|
|
/// <param name="inObj"></param>
|
|
/// <returns></returns>
|
|
[HttpPut("{id}")]
|
|
public async Task<IActionResult> PutUser([FromRoute] long id, [FromBody] User inObj)
|
|
{
|
|
if (!serverState.IsOpen)
|
|
{
|
|
return StatusCode(503, new ApiErrorResponse(ApiErrorCode.API_CLOSED, null, serverState.Reason));
|
|
}
|
|
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return BadRequest(new ApiErrorResponse(ModelState));
|
|
}
|
|
|
|
var o = await ct.User.SingleOrDefaultAsync(m => m.Id == id);
|
|
|
|
if (o == null)
|
|
{
|
|
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
|
|
}
|
|
|
|
if (!Authorized.IsAuthorizedToModify(HttpContext.Items, AyaType.User, o.OwnerId))
|
|
{
|
|
return StatusCode(401, new ApiNotAuthorizedResponse());
|
|
}
|
|
|
|
//Instantiate the business object handler
|
|
UserBiz biz = new UserBiz(ct, UserIdFromContext.Id(HttpContext.Items), UserRolesFromContext.Roles(HttpContext.Items));
|
|
|
|
if (!biz.Put(o, inObj))
|
|
{
|
|
return BadRequest(new ApiErrorResponse(biz.Errors));
|
|
}
|
|
|
|
try
|
|
{
|
|
//Log
|
|
EventLogProcessor.AddEntry(new Event(biz.userId, o.Id, AyaType.User, AyaEvent.Modified), ct);
|
|
await ct.SaveChangesAsync();
|
|
Search.ProcessUpdatedObjectKeywords(ct, UserLocaleIdFromContext.Id(HttpContext.Items), o.Id, AyaType.User, o.Name, o.EmployeeNumber, o.Notes, o.Name);
|
|
}
|
|
catch (DbUpdateConcurrencyException)
|
|
{
|
|
if (!UserExists(id))
|
|
{
|
|
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
|
|
}
|
|
else
|
|
{
|
|
//exists but was changed by another user
|
|
//I considered returning new and old record, but where would it end?
|
|
//Better to let the client decide what to do than to send extra data that is not required
|
|
return StatusCode(409, new ApiErrorResponse(ApiErrorCode.CONCURRENCY_CONFLICT));
|
|
}
|
|
}
|
|
|
|
|
|
|
|
return Ok(new ApiOkResponse(new { ConcurrencyToken = o.ConcurrencyToken }));
|
|
}
|
|
|
|
|
|
|
|
/// <summary>
|
|
/// Patch (update) User
|
|
///
|
|
/// Required roles:
|
|
/// BizAdminFull
|
|
///
|
|
/// </summary>
|
|
/// <param name="id"></param>
|
|
/// <param name="concurrencyToken"></param>
|
|
/// <param name="objectPatch"></param>
|
|
/// <returns></returns>
|
|
[HttpPatch("{id}/{concurrencyToken}")]
|
|
public async Task<IActionResult> PatchUser([FromRoute] long id, [FromRoute] uint concurrencyToken, [FromBody]JsonPatchDocument<User> objectPatch)
|
|
{
|
|
if (!serverState.IsOpen)
|
|
{
|
|
return StatusCode(503, new ApiErrorResponse(ApiErrorCode.API_CLOSED, null, serverState.Reason));
|
|
}
|
|
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return BadRequest(new ApiErrorResponse(ModelState));
|
|
}
|
|
|
|
//Instantiate the business object handler
|
|
UserBiz biz = new UserBiz(ct, UserIdFromContext.Id(HttpContext.Items), UserRolesFromContext.Roles(HttpContext.Items));
|
|
|
|
|
|
var o = await ct.User.SingleOrDefaultAsync(m => m.Id == id);
|
|
|
|
if (o == null)
|
|
{
|
|
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
|
|
}
|
|
|
|
if (!Authorized.IsAuthorizedToModify(HttpContext.Items, AyaType.User, o.OwnerId))
|
|
{
|
|
return StatusCode(401, new ApiNotAuthorizedResponse());
|
|
}
|
|
|
|
//patch and validate
|
|
if (!biz.Patch(o, objectPatch, concurrencyToken))
|
|
{
|
|
return BadRequest(new ApiErrorResponse(biz.Errors));
|
|
}
|
|
|
|
try
|
|
{
|
|
//Log
|
|
EventLogProcessor.AddEntry(new Event(biz.userId, o.Id, AyaType.User, AyaEvent.Modified), ct);
|
|
await ct.SaveChangesAsync();
|
|
Search.ProcessUpdatedObjectKeywords(ct, UserLocaleIdFromContext.Id(HttpContext.Items), o.Id, AyaType.User, o.Name, o.EmployeeNumber, o.Notes, o.Name);
|
|
}
|
|
catch (DbUpdateConcurrencyException)
|
|
{
|
|
if (!UserExists(id))
|
|
{
|
|
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
|
|
}
|
|
else
|
|
{
|
|
return StatusCode(409, new ApiErrorResponse(ApiErrorCode.CONCURRENCY_CONFLICT));
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
return Ok(new ApiOkResponse(new { ConcurrencyToken = o.ConcurrencyToken }));
|
|
}
|
|
|
|
|
|
/// <summary>
|
|
/// Post User
|
|
///
|
|
/// Required roles:
|
|
/// BizAdminFull
|
|
///
|
|
/// </summary>
|
|
/// <param name="inObj"></param>
|
|
/// <returns></returns>
|
|
[HttpPost]
|
|
public async Task<IActionResult> PostUser([FromBody] User inObj)
|
|
{
|
|
if (!serverState.IsOpen)
|
|
{
|
|
return StatusCode(503, new ApiErrorResponse(ApiErrorCode.API_CLOSED, null, serverState.Reason));
|
|
}
|
|
|
|
//If a user has change roles, or editOwnRoles then they can create, true is passed for isOwner since they are creating so by definition the owner
|
|
if (!Authorized.IsAuthorizedToCreate(HttpContext.Items, AyaType.User))
|
|
{
|
|
return StatusCode(401, new ApiNotAuthorizedResponse());
|
|
}
|
|
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return BadRequest(new ApiErrorResponse(ModelState));
|
|
}
|
|
|
|
//Instantiate the business object handler
|
|
UserBiz biz = new UserBiz(ct, UserIdFromContext.Id(HttpContext.Items), UserRolesFromContext.Roles(HttpContext.Items));
|
|
|
|
//Create and validate
|
|
User o = await biz.CreateAsync(inObj);
|
|
|
|
if (o == null)
|
|
{
|
|
//error return
|
|
return BadRequest(new ApiErrorResponse(biz.Errors));
|
|
}
|
|
else
|
|
{
|
|
|
|
//EVENT LOG
|
|
//Note that event log is processed in the biz object unlike the widget for no apparent reason
|
|
|
|
//SEARCH INDEXING
|
|
Search.ProcessNewObjectKeywords(ct, UserLocaleIdFromContext.Id(HttpContext.Items), o.Id, AyaType.User, o.Name, o.EmployeeNumber, o.Notes, o.Name);
|
|
|
|
//return success and link
|
|
//NOTE: this is a USER object so we don't want to return some key fields for security reasons
|
|
//which is why the object is "cleaned" before return
|
|
return CreatedAtAction("GetUser", new { id = o.Id }, new ApiCreatedResponse(UserBiz.CleanUserForReturn(o)));
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
/// <summary>
|
|
/// Delete User
|
|
///
|
|
/// Required roles:
|
|
/// BizAdminFull
|
|
///
|
|
/// </summary>
|
|
/// <param name="id"></param>
|
|
/// <returns>Ok</returns>
|
|
[HttpDelete("{id}")]
|
|
public async Task<IActionResult> DeleteUser([FromRoute] long id)
|
|
{
|
|
if (!serverState.IsOpen)
|
|
{
|
|
return StatusCode(503, new ApiErrorResponse(ApiErrorCode.API_CLOSED, null, serverState.Reason));
|
|
}
|
|
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return BadRequest(new ApiErrorResponse(ModelState));
|
|
}
|
|
|
|
var dbObj = await ct.User.SingleOrDefaultAsync(m => m.Id == id);
|
|
if (dbObj == null)
|
|
{
|
|
return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
|
|
}
|
|
|
|
if (!Authorized.IsAuthorizedToDelete(HttpContext.Items, AyaType.User, dbObj.OwnerId))
|
|
{
|
|
return StatusCode(401, new ApiNotAuthorizedResponse());
|
|
}
|
|
|
|
//Instantiate the business object handler
|
|
UserBiz biz = new UserBiz(ct, UserIdFromContext.Id(HttpContext.Items), UserRolesFromContext.Roles(HttpContext.Items));
|
|
if (!biz.Delete(dbObj))
|
|
{
|
|
return BadRequest(new ApiErrorResponse(biz.Errors));
|
|
}
|
|
|
|
//Log
|
|
EventLogProcessor.DeleteObject(biz.userId, AyaType.User, dbObj.Id, dbObj.Name, ct);
|
|
await ct.SaveChangesAsync();
|
|
|
|
//Delete children / attached objects
|
|
biz.DeleteChildren(dbObj);
|
|
|
|
//This will directly execute and is not part of context for saving purposes
|
|
Search.ProcessDeletedObjectKeywords(ct, dbObj.Id, AyaType.User);
|
|
|
|
|
|
return NoContent();
|
|
}
|
|
|
|
|
|
private bool UserExists(long id)
|
|
{
|
|
return ct.User.Any(e => e.Id == id);
|
|
}
|
|
|
|
|
|
//------------
|
|
|
|
}//eoc
|
|
}//eons |