fixed small bugs + added better auth checks

XpiritBV · Oct 19, 2019 · 233a020 · 233a020
1 parent 11aa442
commit 233a020
Show file tree

Hide file tree

Showing 9 changed files with 88 additions and 33 deletions.
diff --git a/Xpirit.BeerXchange/Controllers/BeerAdditionController.cs b/Xpirit.BeerXchange/Controllers/BeerAdditionController.cs
@@ -10,7 +10,7 @@
 
 namespace Xpirit.BeerXchange.Controllers
 {
-    //[Authorize]
+    [Authorize]
     [Route("api/[controller]")]
     [ApiController]
     public class BeerAdditionController : ControllerBase
@@ -38,7 +38,7 @@ public async Task<IActionResult> Post([FromBody]BeerAddition beerAdditionRequest
             beer.Country = beerAdditionRequest.Country;
             beer.AddedDate = DateTime.Now;
 
-            if (beerAdditionRequest.switchedBeer.HasValue)
+            if (beerAdditionRequest.switchedBeer.HasValue && beerAdditionRequest.switchedBeer.Value != -1)
             {
                 var switchedBeer  = await beerService.GetBeerById(beerAdditionRequest.switchedBeer.Value);
                 if (switchedBeer.RemovedDate.HasValue || !string.IsNullOrEmpty(switchedBeer.RemovedBy))

diff --git a/Xpirit.BeerXchange/Controllers/BeerController.cs b/Xpirit.BeerXchange/Controllers/BeerController.cs
@@ -7,13 +7,11 @@
 using Xpirit.BeerXchange.Model;
 using Xpirit.BeerXchange.Services;
 
-// For more information on enabling Web API for empty projects, visit https://go.microsoft.com/fwlink/?LinkID=397860
-
 namespace Xpirit.BeerXchange.Controllers
 {
     [Authorize]
     [Route("api/[controller]")]
-
+    [ApiController]
     public class BeerController : Controller
     {
         private readonly IBeerService beerService;

diff --git a/Xpirit.BeerXchange/Controllers/BeerRemovalController.cs b/Xpirit.BeerXchange/Controllers/BeerRemovalController.cs
@@ -10,7 +10,7 @@
 
 namespace Xpirit.BeerXchange.Controllers
 {
-    //[Authorize]
+    [Authorize]
     [Route("api/[controller]")]
     [ApiController]
     public class BeerRemovalController : ControllerBase
@@ -30,11 +30,14 @@ public async Task<IActionResult> Post([FromBody]BeerRemoval beerRemovalRequest)
             {
                 return BadRequest("Not a valid Beer removal request");
             }
-
             var user = $"{User.Claims.Where(c => c.Type == System.Security.Claims.ClaimTypes.GivenName).FirstOrDefault().Value} {User.Claims.Where(c => c.Type == System.Security.Claims.ClaimTypes.Surname).FirstOrDefault().Value}";
 
+            if (!(await beerService.GetUserCredits(user) > 0))
+            {
+                return BadRequest("User does not have enough credits to remove beer");
+            }
+
 
-            //User.Claims.Where(c => c.Type == System.Security.Claims.ClaimTypes.Name).FirstOrDefault();
             var beer = await beerService.GetBeerById(beerRemovalRequest.BeerId);
             beer.RemovedDate = DateTime.Now;
             beer.RemovedBy = user;

diff --git a/Xpirit.BeerXchange/Controllers/CreditController.cs b/Xpirit.BeerXchange/Controllers/CreditController.cs
@@ -7,12 +7,11 @@
 using Xpirit.BeerXchange.Model;
 using Xpirit.BeerXchange.Services;
 
-// For more information on enabling Web API for empty projects, visit https://go.microsoft.com/fwlink/?LinkID=397860
-
 namespace Xpirit.BeerXchange.Controllers
 {
-    [Route("api/[controller]")]
     [Authorize]
+    [Route("api/[controller]")]
+    [ApiController]
     public class CreditController : Controller
     {
         private readonly IBeerService beerService;

diff --git a/Xpirit.BeerXchange/Controllers/CreditTransferController.cs b/Xpirit.BeerXchange/Controllers/CreditTransferController.cs
@@ -10,7 +10,7 @@
 
 namespace Xpirit.BeerXchange.Controllers
 {
-    //[Authorize]
+    [Authorize]
     [Route("api/[controller]")]
     [ApiController]
     public class CreditTransferController : ControllerBase
@@ -32,6 +32,13 @@ public async Task<IActionResult> Post([FromBody]CreditTransfer creditTransfer)
                 return BadRequest("invalid beerId");
             }
 
+            var user = $"{User.Claims.Where(c => c.Type == System.Security.Claims.ClaimTypes.GivenName).FirstOrDefault().Value} {User.Claims.Where(c => c.Type == System.Security.Claims.ClaimTypes.Surname).FirstOrDefault().Value}";
+
+            if (beer.CreatedBy != user)
+            {
+                return BadRequest($"Invalid beerId, Beer not owned by user {user}");
+            }
+
             beer.CreatedBy = creditTransfer.CreditReceiver;
 
             await beerService.UpdateBeer(beer);

diff --git a/Xpirit.BeerXchange/Controllers/UserController.cs b/Xpirit.BeerXchange/Controllers/UserController.cs
@@ -2,12 +2,14 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Xpirit.BeerXchange.Services;
 
 namespace Xpirit.BeerXchange.Controllers
 {
+    [Authorize]
     [Route("api/[controller]")]
     [ApiController]
     public class UserController : ControllerBase