mirror of
https://github.com/jellyfin/jellyfin
synced 2024-09-29 20:44:35 +00:00
Add default auth policy to generated openapi spec (#11181)
This commit is contained in:
parent
c16135800c
commit
d9e35a969f
|
@ -1,91 +1,105 @@
|
|||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using Jellyfin.Api.Auth.DefaultAuthorizationPolicy;
|
||||
using Jellyfin.Api.Constants;
|
||||
using Jellyfin.Extensions;
|
||||
using Microsoft.AspNetCore.Authorization;
|
||||
using Microsoft.OpenApi.Models;
|
||||
using Swashbuckle.AspNetCore.SwaggerGen;
|
||||
|
||||
namespace Jellyfin.Server.Filters
|
||||
namespace Jellyfin.Server.Filters;
|
||||
|
||||
/// <summary>
|
||||
/// Security requirement operation filter.
|
||||
/// </summary>
|
||||
public class SecurityRequirementsOperationFilter : IOperationFilter
|
||||
{
|
||||
private const string DefaultAuthPolicy = "DefaultAuthorization";
|
||||
private static readonly Type _attributeType = typeof(AuthorizeAttribute);
|
||||
|
||||
private readonly IAuthorizationPolicyProvider _authorizationPolicyProvider;
|
||||
|
||||
/// <summary>
|
||||
/// Security requirement operation filter.
|
||||
/// Initializes a new instance of the <see cref="SecurityRequirementsOperationFilter"/> class.
|
||||
/// </summary>
|
||||
public class SecurityRequirementsOperationFilter : IOperationFilter
|
||||
/// <param name="authorizationPolicyProvider">The authorization policy provider.</param>
|
||||
public SecurityRequirementsOperationFilter(IAuthorizationPolicyProvider authorizationPolicyProvider)
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Apply(OpenApiOperation operation, OperationFilterContext context)
|
||||
_authorizationPolicyProvider = authorizationPolicyProvider;
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public void Apply(OpenApiOperation operation, OperationFilterContext context)
|
||||
{
|
||||
var requiredScopes = new List<string>();
|
||||
|
||||
var requiresAuth = false;
|
||||
// Add all method scopes.
|
||||
foreach (var authorizeAttribute in context.MethodInfo.GetCustomAttributes(_attributeType, true).Cast<AuthorizeAttribute>())
|
||||
{
|
||||
var requiredScopes = new List<string>();
|
||||
|
||||
var requiresAuth = false;
|
||||
// Add all method scopes.
|
||||
foreach (var attribute in context.MethodInfo.GetCustomAttributes(true))
|
||||
requiresAuth = true;
|
||||
var policy = authorizeAttribute.Policy ?? DefaultAuthPolicy;
|
||||
if (!requiredScopes.Contains(policy, StringComparer.Ordinal))
|
||||
{
|
||||
if (attribute is not AuthorizeAttribute authorizeAttribute)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
requiresAuth = true;
|
||||
if (authorizeAttribute.Policy is not null
|
||||
&& !requiredScopes.Contains(authorizeAttribute.Policy, StringComparer.Ordinal))
|
||||
{
|
||||
requiredScopes.Add(authorizeAttribute.Policy);
|
||||
}
|
||||
requiredScopes.Add(policy);
|
||||
}
|
||||
|
||||
// Add controller scopes if any.
|
||||
var controllerAttributes = context.MethodInfo.DeclaringType?.GetCustomAttributes(true);
|
||||
if (controllerAttributes is not null)
|
||||
{
|
||||
foreach (var attribute in controllerAttributes)
|
||||
{
|
||||
if (attribute is not AuthorizeAttribute authorizeAttribute)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
requiresAuth = true;
|
||||
if (authorizeAttribute.Policy is not null
|
||||
&& !requiredScopes.Contains(authorizeAttribute.Policy, StringComparer.Ordinal))
|
||||
{
|
||||
requiredScopes.Add(authorizeAttribute.Policy);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!requiresAuth)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
if (!operation.Responses.ContainsKey("401"))
|
||||
{
|
||||
operation.Responses.Add("401", new OpenApiResponse { Description = "Unauthorized" });
|
||||
}
|
||||
|
||||
if (!operation.Responses.ContainsKey("403"))
|
||||
{
|
||||
operation.Responses.Add("403", new OpenApiResponse { Description = "Forbidden" });
|
||||
}
|
||||
|
||||
var scheme = new OpenApiSecurityScheme
|
||||
{
|
||||
Reference = new OpenApiReference
|
||||
{
|
||||
Type = ReferenceType.SecurityScheme,
|
||||
Id = AuthenticationSchemes.CustomAuthentication
|
||||
}
|
||||
};
|
||||
|
||||
operation.Security = new List<OpenApiSecurityRequirement>
|
||||
{
|
||||
new OpenApiSecurityRequirement
|
||||
{
|
||||
[scheme] = requiredScopes
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
// Add controller scopes if any.
|
||||
var controllerAttributes = context.MethodInfo.DeclaringType?.GetCustomAttributes(_attributeType, true).Cast<AuthorizeAttribute>();
|
||||
if (controllerAttributes is not null)
|
||||
{
|
||||
foreach (var authorizeAttribute in controllerAttributes)
|
||||
{
|
||||
requiresAuth = true;
|
||||
var policy = authorizeAttribute.Policy ?? DefaultAuthPolicy;
|
||||
if (!requiredScopes.Contains(policy, StringComparer.Ordinal))
|
||||
{
|
||||
requiredScopes.Add(policy);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!requiresAuth)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
if (!operation.Responses.ContainsKey("401"))
|
||||
{
|
||||
operation.Responses.Add("401", new OpenApiResponse { Description = "Unauthorized" });
|
||||
}
|
||||
|
||||
if (!operation.Responses.ContainsKey("403"))
|
||||
{
|
||||
operation.Responses.Add("403", new OpenApiResponse { Description = "Forbidden" });
|
||||
}
|
||||
|
||||
var scheme = new OpenApiSecurityScheme
|
||||
{
|
||||
Reference = new OpenApiReference
|
||||
{
|
||||
Type = ReferenceType.SecurityScheme,
|
||||
Id = AuthenticationSchemes.CustomAuthentication
|
||||
},
|
||||
};
|
||||
|
||||
// Add DefaultAuthorization scope to any endpoint that has a policy with a requirement that is a subset of DefaultAuthorization.
|
||||
if (!requiredScopes.Contains(DefaultAuthPolicy.AsSpan(), StringComparison.Ordinal))
|
||||
{
|
||||
foreach (var scope in requiredScopes)
|
||||
{
|
||||
var authorizationPolicy = _authorizationPolicyProvider.GetPolicyAsync(scope).GetAwaiter().GetResult();
|
||||
if (authorizationPolicy is not null
|
||||
&& authorizationPolicy.Requirements.Any(r => r is DefaultAuthorizationRequirement))
|
||||
{
|
||||
requiredScopes.Add(DefaultAuthPolicy);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
operation.Security = [new OpenApiSecurityRequirement { [scheme] = requiredScopes }];
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue