raven/server/AyaNova/Controllers/CustomerServiceRequestController.cs

using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
using Microsoft.AspNetCore.Routing;
using Microsoft.AspNetCore.Authorization;
using Microsoft.Extensions.Logging;
using AyaNova.Models;
using AyaNova.Api.ControllerHelpers;
using AyaNova.Biz;



namespace AyaNova.Api.Controllers
{
    [ApiController]
    [Asp.Versioning.ApiVersion("8.0")]
    [Route("api/v{version:apiVersion}/csr")]
    [Produces("application/json")]
    [Authorize]
    public class CustomerServiceRequestController : ControllerBase
    {
        private readonly AyContext ct;
        private readonly ILogger<CustomerServiceRequestController> log;
        private readonly ApiServerState serverState;

        /// <summary>
        /// ctor
        /// </summary>
        /// <param name="dbcontext"></param>
        /// <param name="logger"></param>
        /// <param name="apiServerState"></param>  
        public CustomerServiceRequestController(AyContext dbcontext, ILogger<CustomerServiceRequestController> logger, ApiServerState apiServerState)
        {
            ct = dbcontext;
            log = logger;
            serverState = apiServerState;
        }

        /// <summary>
        /// Create CustomerServiceRequest
        /// </summary>
        /// <param name="newObject"></param>
        /// <param name="apiVersion">From route path</param>
        /// <returns></returns>
        [HttpPost]
        public async Task<IActionResult> PostCustomerServiceRequest([FromBody] CustomerServiceRequest newObject, Asp.Versioning.ApiVersion apiVersion)
        {
            if (!serverState.IsOpen)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
            CustomerServiceRequestBiz biz = CustomerServiceRequestBiz.GetBiz(ct, HttpContext);
            if (!Authorized.HasCreateRole(HttpContext.Items, biz.BizType))
                return StatusCode(403, new ApiNotAuthorizedResponse());
            if (!ModelState.IsValid)
                return BadRequest(new ApiErrorResponse(ModelState));
            if (!await ContactMayUseCustomerAsync(newObject.CustomerId))
                return StatusCode(403, new ApiNotAuthorizedResponse());
            //case 4712: a contact's request is always requested by that contact
            var userType = UserTypeFromContext.Type(HttpContext.Items);
            if (userType == UserType.Customer || userType == UserType.HeadOffice)
                newObject.RequestedByUserId = UserIdFromContext.Id(HttpContext.Items);
            CustomerServiceRequest o = await biz.CreateAsync(newObject);
            if (o == null)
                return BadRequest(new ApiErrorResponse(biz.Errors));
            else
                return CreatedAtAction(nameof(CustomerServiceRequestController.GetCustomerServiceRequest), new { id = o.Id, version = apiVersion.ToString() }, new ApiCreatedResponse(o));
        }

        

        /// <summary>
        /// Get CustomerServiceRequest
        /// </summary>
        /// <param name="id"></param>
        /// <returns>CustomerServiceRequest</returns>
        [HttpGet("{id}")]
        public async Task<IActionResult> GetCustomerServiceRequest([FromRoute] long id)
        {
            if (!serverState.IsOpen)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
            CustomerServiceRequestBiz biz = CustomerServiceRequestBiz.GetBiz(ct, HttpContext);
            if (!Authorized.HasReadFullRole(HttpContext.Items, biz.BizType))
                return StatusCode(403, new ApiNotAuthorizedResponse());
            if (!ModelState.IsValid)
                return BadRequest(new ApiErrorResponse(ModelState));
            if (!await ContactMayUseExistingAsync(id))
                return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
            var o = await biz.GetAsync(id);
            if (o == null) return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
            return Ok(ApiOkResponse.Response(o));
        }

        /// <summary>
        /// Update CustomerServiceRequest
        /// </summary>        
        /// <param name="updatedObject"></param>
        /// <returns></returns>
        [HttpPut]
        public async Task<IActionResult> PutCustomerServiceRequest([FromBody] CustomerServiceRequest updatedObject)
        {
            if (!serverState.IsOpen)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
            if (!ModelState.IsValid)
                return BadRequest(new ApiErrorResponse(ModelState));
            CustomerServiceRequestBiz biz = CustomerServiceRequestBiz.GetBiz(ct, HttpContext);
            if (!Authorized.HasModifyRole(HttpContext.Items, biz.BizType))
                return StatusCode(403, new ApiNotAuthorizedResponse());
            if (!await ContactMayUseExistingAsync(updatedObject.Id))
                return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
            if (!await ContactMayUseCustomerAsync(updatedObject.CustomerId))
                return StatusCode(403, new ApiNotAuthorizedResponse());
            var o = await biz.PutAsync(updatedObject);
            if (o == null)
            {
                if (biz.Errors.Exists(z => z.Code == ApiErrorCode.CONCURRENCY_CONFLICT))
                    return StatusCode(409, new ApiErrorResponse(biz.Errors));
                else
                    return BadRequest(new ApiErrorResponse(biz.Errors));
            }
            return Ok(ApiOkResponse.Response(new { Concurrency = o.Concurrency })); ;
        }

        /// <summary>
        /// Delete CustomerServiceRequest
        /// </summary>
        /// <param name="id"></param>
        /// <returns>NoContent</returns>
        [HttpDelete("{id}")]
        public async Task<IActionResult> DeleteCustomerServiceRequest([FromRoute] long id)
        {
            if (!serverState.IsOpen)
                return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
            if (!ModelState.IsValid)
                return BadRequest(new ApiErrorResponse(ModelState));
            CustomerServiceRequestBiz biz = CustomerServiceRequestBiz.GetBiz(ct, HttpContext);
            if (!Authorized.HasDeleteRole(HttpContext.Items, biz.BizType))
                return StatusCode(403, new ApiNotAuthorizedResponse());
            if (!await ContactMayUseExistingAsync(id))
                return NotFound(new ApiErrorResponse(ApiErrorCode.NOT_FOUND));
            if (!await biz.DeleteAsync(id))
                return BadRequest(new ApiErrorResponse(biz.Errors));
            return NoContent();
        }

        //case 4712: a customer contact works only with its own customer's service requests (staff: always true)
        private async Task<bool> ContactMayUseCustomerAsync(long customerId)
        {
            var userType = UserTypeFromContext.Type(HttpContext.Items);
            if (userType != UserType.Customer && userType != UserType.HeadOffice)
                return true;
            return await UserBiz.CustomerContactOwnsCustomerAsync(ct, UserIdFromContext.Id(HttpContext.Items), customerId);
        }

        //case 4712: same for an existing service request (true if it does not exist, so the normal not found applies)
        private async Task<bool> ContactMayUseExistingAsync(long id)
        {
            var userType = UserTypeFromContext.Type(HttpContext.Items);
            if (userType != UserType.Customer && userType != UserType.HeadOffice)
                return true;
            var customerId = await ct.CustomerServiceRequest.AsNoTracking().Where(z => z.Id == id).Select(z => (long?)z.CustomerId).FirstOrDefaultAsync();
            return customerId == null || await UserBiz.CustomerContactOwnsCustomerAsync(ct, UserIdFromContext.Id(HttpContext.Items), (long)customerId);
        }

      


        //------------


    }//eoc
}//eons