Best way to do property level authorization in ServiceStack?

问题

I'm currently developing a SPA in Angular, and so I've created a REST service using ServiceStack. I am also using ServiceStack's default authentication and authorization solution, which allows me to decorate services with the Authenticate attribute, and also allows me to authorize roles.

However, since my application has users, and users own resources, I need a way to restrict non-authorized users from performing certain actions. Furthermore, I would like to be able to create a single service for each discrete entity which can properly figure out what is safe to write to the database and what is safe to return to the user depending on their level of authorization.

So as an example, let's say I've created a service to handle operations on a Group entity. One of the actions I allow on a Group is to get the details for it:

Route: api/groups/{Id}
Response: Name, Description, CoverImageUrl, Members

However, depending on who the user is, I wish to restrict what data is returned:

Not authenticated: Name, CoverImageUrl
Authenticated: Name, CoverImageUrl, Decription
Member of requested group: Full access
Admin of website: Full access

So one simple approach to doing this is to create 3 different response DTOs, one for each type of response. Then in the service itself I can check who the user is, check on their relation to the resource, and return the appropriate response. The problem with this approach is that I would be repeating myself a lot, and would be creating DTOs that are simply subsets of the "master" DTO.

For me, the ideal solution would be some way to decorate each property on the DTO with attributes like:

[CanRead("Admin", "Owner", "Member")]
[CanWrite("Admin", "Owner")]

Then somewhere during the request, it would limit what is written to the database based on who the user is and would only serialize the subset of the "master" DTO that the user is permitted to read.

Does anyone know how I can attain my ideal solution within ServiceStack, or perhaps something even better?

回答1:

The direct approach is the easiest, but you could also take advantage of custom filters attributes.

[Route("/groups/{Id}"]
public class UpdateGroup
{
    public int Id { get; set; }
    public string Name { get; set; }
    public string CoverImageUrl { get; set; }
    public string Description { get; set; }
}

[RequiresAnyRole("Admin", "FullAccess")]
[Route("/admin/groups/{Id}"]
public class AdminUpdateGroup
{
    public int Id { get; set; }
    public string Name { get; set; }
    public string CoverImageUrl { get; set; }
    public string Description { get; set; }
    //... other admin properties
}

Service implementation:

public object Any(UpdateGroup request)
{
    var session = base.SessionAs<AuthUserSession>();
    if (session.IsAuthenticated) {
        //.. update Name, CoverImageUrl, Description
    }
    else {
        //.. only update Name, CoverImageUrl
    }
}

public object Any(AdminUpdateGroup request)
{
    //... Full Access
}

回答2:

What ended up being the most pragmatic solution for me was actually pretty simple. The basic idea is that whichever service requires row-level authorization should implement a GetUserRole method, which in my case returns the user's most permissive role.

protected string GetUserRole(Domain.Group entity)
{
    var session = SessionAs<AuthUserSession>();
    var username = session.UserName;

    if (session.Roles.Contains("Admin"))
    {
        return "Admin";
    }

    if (entity.Id == default(int) || entity.Leader.Username.Equals(username))
    {
        return "Leader";
    }

    // More logic here...

    return session.IsAuthenticated ? "User" : "Anonymous";
}

Then I can use the user's role to figure out what to let them write:

var entityToWriteTo = ... // code that gets your entity
var userRole = GetUserRole(entityToWriteTo);

if (new[] {"Admin"}.Contains(userRole))
{
    // write to admin-only entity properties
}

if (new[] {"Admin", "Leader"}.Contains(userRole))
{
    // write to admin or leader entity properties
}

// Etc.

And the same logic applies for reads: You populate a DTO with properties set conditionally based on their role. Later on when you return the DTO back to the client, any properties that you haven't set either won't be serialized or will be serialized with a null value.

Ultimately, this solution allows you to use a single service for a resource instead of creating multiple services each with their own request DTO. There are, of course, refactorings you can do that makes this solution more streamlined. For example, you can isolate all of your reads and writes to one part of your code which will keep the services themselves free of role checks and things like that.

来源：https://stackoverflow.com/questions/28991251/best-way-to-do-property-level-authorization-in-servicestack

标签

.net

angularjs

entity-framework

servicestack