Elsa integration with authorization #3161

2 Answer(s)

• 

  0

  liangshiwei created 4 years ago

  Fullstack Developer

  Hi,

  we will check it out.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  liangshiwei created 4 years ago

  Fullstack Developer

  Hi,

  I have checked.

  It works for me:

  

  But, it's not a good solution, because RequireAuthorization protects all controllers, including Elsa's API controllers. It's like adding [AuthorizeAttribute] to all controllers.

  It breaks the default behavior of all controllers, even though it doesn't require authorization.

  You can check this: https://community.abp.io/posts/using-elsa-workflow-with-the-abp-framework-773siqi9 . It explains protecting elsa dashboard pages based on permissions

  For API endpoints, you can try this:

  public class ElsaActionFilter: IAsyncActionFilter, ITransientDependency
  {
      private readonly ICurrentUser _currentUser;
      private readonly IPermissionChecker _permissionChecker;
  
      public ElsaActionFilter(IPermissionChecker permissionChecker, ICurrentUser currentUser)
      {
          _permissionChecker = permissionChecker;
          _currentUser = currentUser;
      }
  
      public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
      {
          if (context.Controller.GetType().FullName.StartsWith("Elsa.Server.Api.Endpoints"))
          {
              //elsa api endpoint
              if (!_currentUser.IsAuthenticated)
              {
                  context.Result = new UnauthorizedResult();
                  return;
              }
              
              if (!await _permissionChecker.IsGrantedAsync("PermissionName..."))
              {
                  context.Result = new UnauthorizedResult();
                  return;
              }
              
              await next();
          }
          else
          {
              await next();
          }
      }
  }
  

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel