Angular Permissions on client not the same as backend API with Custom PermissionValueProvider #10108

1 Answer(s)

• 

  0

  AI-Bot created 7 hours ago

  Support Team ABP Agent

  1. Solution

  • Root cause

    • Angular’s PermissionService reads grantedPolicies from the Application Configuration endpoint (/api/abp/application-configuration). On the backend, this endpoint builds grantedPolicies using IPermissionChecker.IsGrantedAsync(string[] names) to evaluate multiple permissions at once for efficiency.
    • In current ABP, the single-permission check and multi-permission check use different resolution flows: for a single permission, all registered PermissionValueProviders participate and any Prohibited overrides Granted (as documented). For multiple permissions, the evaluation short-circuits by returning the first non-Undefined result from the providers, so provider registration order affects the outcome. If your custom PermissionValueProvider that returns Prohibited is registered after a provider that returns Granted, the multi-permission path may never “see” your Prohibited result. This leads to grantedPolicies including PermissionA even though your backend AuthorizationService.CheckAsync("PermissionA") fails (because Check/IsGranted for a single permission considers all providers and respects Prohibited-overrides-Granted).

  • How to get consistent results (server and Angular)

    1. Ensure your custom provider runs before the built-ins when building grantedPolicies
       • Register your provider at the beginning, so its Prohibited can take precedence in the multi-permission path used by application configuration.
       • Example:

  Configure<PermissionOptions>(options =>
         {
             // Insert at the beginning to ensure it’s checked first
             options.ValueProviders.Insert(0, typeof(MyCustomPermissionValueProvider));
             // If you previously used Add(), it appends to the end — change it to Insert(0, ...)
         });
  

  2. Prefer single-permission checks when building grantedPolicies
     • If you have overridden the AbpApplicationConfigurationAppService or produce your own grantedPolicies map, ensure you use IPermissionChecker.IsGrantedAsync(string name) per permission instead of the overload that accepts a list. That guarantees the “all providers participate, Prohibited overrides Granted” behavior for each permission:

  // Pseudocode inside your configuration builder
         foreach (var permission in permissionDefinitionManager.GetPermissions())
         {
             var granted = await permissionChecker.IsGrantedAsync(permission.Name);
             if (granted)
             {
                 dto.Auth.GrantedPolicies[permission.Name] = true;
             }
         }
  

   - If you haven’t overridden anything, fixing provider order (step 1) is typically sufficient.
  

  3. If you must use the multi-permission overload for performance, enforce provider precedence
     • Keep using IsGrantedAsync(string[] names) but make sure your custom provider is ordered first (Insert(0, ...)). This ensures the first non-Undefined is your Prohibited result for any permissions it handles.
  4. Double-check your provider logic
     • Return PermissionGrantResult.Prohibited only for the permissions you truly want to block.
     • Return PermissionGrantResult.Undefined for everything else so other providers can participate (role, user, client, etc.).

  • Verification checklist
    • Register your custom provider via Insert(0, typeof(MyCustomPermissionValueProvider)).
    • Confirm /api/abp/application-configuration returns auth.grantedPolicies without the prohibited permission.
    • Confirm Angular’s this.permissionService.getGrantedPolicy('PermissionA') returns false.
    • Confirm backend AuthorizationService.CheckAsync("PermissionA") throws as expected.

  2. Sources

  • https://abp.io/docs/latest/framework/fundamentals/authorization#advanced-topics
  • https://github.com/abpframework/abp

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel