Add policy for admin role (#4124)

dotnet · Nov 4, 2024 · fc65aa7 · fc65aa7
1 parent 78cf8ad
commit fc65aa7
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/src/Maestro/Maestro.Authentication/AuthenticationConfiguration.cs b/src/Maestro/Maestro.Authentication/AuthenticationConfiguration.cs
@@ -23,6 +23,7 @@ public static class AuthenticationConfiguration
 {
     public const string EntraAuthorizationPolicyName = "Entra";
     public const string MsftAuthorizationPolicyName = "msft";
+    public const string AdminAuthorizationPolicyName = "RequireAdminAccess";
 
     public const string AccountSignInRoute = "/Account/SignIn";
 
@@ -111,6 +112,12 @@ public static void ConfigureAuthServices(this IServiceCollection services, IConf
                             || context.User.IsInRole(prodconSvcsRole);
                     });
                 });
+                options.AddPolicy(AdminAuthorizationPolicyName, policy =>
+                {
+                    policy.AddAuthenticationSchemes(AuthenticationSchemes);
+                    policy.RequireAuthenticatedUser();
+                    policy.RequireRole("Admin");
+                });
             });
 
         services.Configure<MvcOptions>(

diff --git a/...ProductConstructionService/ProductConstructionService.Api/Controllers/StatusController.cs b/...ProductConstructionService/ProductConstructionService.Api/Controllers/StatusController.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 
 using System.Net;
+using Maestro.Authentication;
 using Microsoft.AspNetCore.ApiVersioning;
 using Microsoft.AspNetCore.ApiVersioning.Swashbuckle;
 using Microsoft.AspNetCore.Authorization;
@@ -12,6 +13,7 @@ namespace ProductConstructionService.Api.Controllers;
 
 [Route("status")]
 [ApiVersion("2020-02-20")]
+[Authorize(Policy = AuthenticationConfiguration.AdminAuthorizationPolicyName)]
 public class StatusController(IReplicaWorkItemProcessorStateCacheFactory replicaWorkItemProcessorStateCacheFactory) : ControllerBase
 {
     private readonly IReplicaWorkItemProcessorStateCacheFactory _replicaWorkItemProcessorStateCacheFactory = replicaWorkItemProcessorStateCacheFactory;