| | | 1 | | using System; |
| | | 2 | | using System.Collections.Generic; |
| | | 3 | | using System.Linq; |
| | | 4 | | using Jellyfin.Api.Auth.DefaultAuthorizationPolicy; |
| | | 5 | | using Jellyfin.Api.Constants; |
| | | 6 | | using Jellyfin.Extensions; |
| | | 7 | | using Microsoft.AspNetCore.Authorization; |
| | | 8 | | using Microsoft.OpenApi.Models; |
| | | 9 | | using Swashbuckle.AspNetCore.SwaggerGen; |
| | | 10 | | |
| | | 11 | | namespace Jellyfin.Server.Filters; |
| | | 12 | | |
| | | 13 | | /// <summary> |
| | | 14 | | /// Security requirement operation filter. |
| | | 15 | | /// </summary> |
| | | 16 | | public class SecurityRequirementsOperationFilter : IOperationFilter |
| | | 17 | | { |
| | | 18 | | private const string DefaultAuthPolicy = "DefaultAuthorization"; |
| | 1 | 19 | | private static readonly Type _attributeType = typeof(AuthorizeAttribute); |
| | | 20 | | |
| | | 21 | | private readonly IAuthorizationPolicyProvider _authorizationPolicyProvider; |
| | | 22 | | |
| | | 23 | | /// <summary> |
| | | 24 | | /// Initializes a new instance of the <see cref="SecurityRequirementsOperationFilter"/> class. |
| | | 25 | | /// </summary> |
| | | 26 | | /// <param name="authorizationPolicyProvider">The authorization policy provider.</param> |
| | | 27 | | public SecurityRequirementsOperationFilter(IAuthorizationPolicyProvider authorizationPolicyProvider) |
| | | 28 | | { |
| | 21 | 29 | | _authorizationPolicyProvider = authorizationPolicyProvider; |
| | 21 | 30 | | } |
| | | 31 | | |
| | | 32 | | /// <inheritdoc /> |
| | | 33 | | public void Apply(OpenApiOperation operation, OperationFilterContext context) |
| | | 34 | | { |
| | 381 | 35 | | var requiredScopes = new List<string>(); |
| | | 36 | | |
| | 381 | 37 | | var requiresAuth = false; |
| | | 38 | | // Add all method scopes. |
| | 1084 | 39 | | foreach (var authorizeAttribute in context.MethodInfo.GetCustomAttributes(_attributeType, true).Cast<AuthorizeAt |
| | | 40 | | { |
| | 161 | 41 | | requiresAuth = true; |
| | 161 | 42 | | var policy = authorizeAttribute.Policy ?? DefaultAuthPolicy; |
| | 161 | 43 | | if (!requiredScopes.Contains(policy, StringComparer.Ordinal)) |
| | | 44 | | { |
| | 161 | 45 | | requiredScopes.Add(policy); |
| | | 46 | | } |
| | | 47 | | } |
| | | 48 | | |
| | | 49 | | // Add controller scopes if any. |
| | 381 | 50 | | var controllerAttributes = context.MethodInfo.DeclaringType?.GetCustomAttributes(_attributeType, true).Cast<Auth |
| | 381 | 51 | | if (controllerAttributes is not null) |
| | | 52 | | { |
| | 1136 | 53 | | foreach (var authorizeAttribute in controllerAttributes) |
| | | 54 | | { |
| | 187 | 55 | | requiresAuth = true; |
| | 187 | 56 | | var policy = authorizeAttribute.Policy ?? DefaultAuthPolicy; |
| | 187 | 57 | | if (!requiredScopes.Contains(policy, StringComparer.Ordinal)) |
| | | 58 | | { |
| | 187 | 59 | | requiredScopes.Add(policy); |
| | | 60 | | } |
| | | 61 | | } |
| | | 62 | | } |
| | | 63 | | |
| | 381 | 64 | | if (!requiresAuth) |
| | | 65 | | { |
| | 59 | 66 | | return; |
| | | 67 | | } |
| | | 68 | | |
| | 322 | 69 | | if (!operation.Responses.ContainsKey("401")) |
| | | 70 | | { |
| | 319 | 71 | | operation.Responses.Add("401", new OpenApiResponse { Description = "Unauthorized" }); |
| | | 72 | | } |
| | | 73 | | |
| | 322 | 74 | | if (!operation.Responses.ContainsKey("403")) |
| | | 75 | | { |
| | 297 | 76 | | operation.Responses.Add("403", new OpenApiResponse { Description = "Forbidden" }); |
| | | 77 | | } |
| | | 78 | | |
| | 322 | 79 | | var scheme = new OpenApiSecurityScheme |
| | 322 | 80 | | { |
| | 322 | 81 | | Reference = new OpenApiReference |
| | 322 | 82 | | { |
| | 322 | 83 | | Type = ReferenceType.SecurityScheme, |
| | 322 | 84 | | Id = AuthenticationSchemes.CustomAuthentication |
| | 322 | 85 | | }, |
| | 322 | 86 | | }; |
| | | 87 | | |
| | | 88 | | // Add DefaultAuthorization scope to any endpoint that has a policy with a requirement that is a subset of Defau |
| | 322 | 89 | | if (!requiredScopes.Contains(DefaultAuthPolicy.AsSpan(), StringComparison.Ordinal)) |
| | | 90 | | { |
| | 531 | 91 | | foreach (var scope in requiredScopes) |
| | | 92 | | { |
| | 158 | 93 | | var authorizationPolicy = _authorizationPolicyProvider.GetPolicyAsync(scope).GetAwaiter().GetResult(); |
| | 158 | 94 | | if (authorizationPolicy is not null |
| | 158 | 95 | | && authorizationPolicy.Requirements.Any(r => r is DefaultAuthorizationRequirement)) |
| | | 96 | | { |
| | 101 | 97 | | requiredScopes.Add(DefaultAuthPolicy); |
| | 101 | 98 | | break; |
| | | 99 | | } |
| | | 100 | | } |
| | | 101 | | } |
| | | 102 | | |
| | 322 | 103 | | operation.Security = [new OpenApiSecurityRequirement { [scheme] = requiredScopes }]; |
| | 322 | 104 | | } |
| | | 105 | | } |