سلام؛ در متد CanUserAccess کلاس SecurityTrimmingService:
ابتدا بررسی میشه که کاربر دارای دسترسی مورد نظر میباشد و سپس چک میشه که کاربر احراز هویت شده و دارای دسترسی admin میباشد.
public bool CanUserAccess(ClaimsPrincipal user, string area, string controller, string action)
{
var currentClaimValue = $"{area}:{controller}:{action}";
var securedControllerActions = _mvcActionsDiscoveryService.GetAllSecuredControllerActionsWithPolicy(ConstantPolicies.DynamicPermission);
if (!securedControllerActions.SelectMany(x => x.MvcActions).Any(x => x.ActionId == currentClaimValue))
{
throw new KeyNotFoundException($@"The `secured` area={area}/controller={controller}/action={action} with `ConstantPolicies.DynamicPermission` policy not found. Please check you have entered the area/controller/action names correctly and also it's decorated with the correct security policy.");
}
if (!user.Identity.IsAuthenticated)
{
return false;
}
if (user.IsInRole(ConstantRoles.Admin))
{
// Admin users have access to all of the pages.
return true;
}
// Check for dynamic permissions
// A user gets its permissions claims from the `ApplicationClaimsPrincipalFactory` class automatically and it includes the role claims too.
return user.HasClaim(claim => claim.Type == ConstantPolicies.DynamicPermissionClaimType &&
claim.Value == currentClaimValue);
} آیا کاربری که دارای دسترسی Admin میباشد نیازی به چک کردن HasClaim دارد؟
مثلا اگر این متد به این صورت نوشته شود مشکلی پیش میاد؟
public bool CanUserAccess(ClaimsPrincipal user, string area, string controller, string action)
{
if (!user.Identity.IsAuthenticated)
{
return false;
}
if (user.IsInRole(ConstantRoles.Admin))
{
// Admin users have access to all of the pages.
return true;
}
var currentClaimValue = $"{area}:{controller}:{action}";
var securedControllerActions = _mvcActionsDiscoveryService.GetAllSecuredControllerActionsWithPolicy(ConstantPolicies.DynamicPermission);
if (!securedControllerActions.SelectMany(x => x.MvcActions).Any(x => x.ActionId == currentClaimValue))
{
throw new KeyNotFoundException($@"The `secured` area={area}/controller={controller}/action={action} with `ConstantPolicies.DynamicPermission` policy not found. Please check you have entered the area/controller/action names correctly and also it's decorated with the correct security policy.");
}
// Check for dynamic permissions
// A user gets its permissions claims from the `ApplicationClaimsPrincipalFactory` class automatically and it includes the role claims too.
return user.HasClaim(claim => claim.Type == ConstantPolicies.DynamicPermissionClaimType &&
claim.Value == currentClaimValue);
} 
