| | | 1 | | using System.Linq.Dynamic.Core; |
| | | 2 | | using Microsoft.Extensions.Logging; |
| | | 3 | | |
| | | 4 | | namespace Services.Authorization.Services; |
| | | 5 | | |
| | | 6 | | /// <summary> |
| | | 7 | | /// Применяет Dynamic LINQ фильтры из DataScope к IQueryable. |
| | | 8 | | /// Выражения получают в контексте параметры @userId и @userName. |
| | | 9 | | /// </summary> |
| | | 10 | | public sealed class DataScopeService : IDataScopeService |
| | | 11 | | { |
| | | 12 | | private readonly IPermissionService _permissions; |
| | | 13 | | private readonly ILogger<DataScopeService> _logger; |
| | | 14 | | |
| | 33 | 15 | | public DataScopeService(IPermissionService permissions, ILogger<DataScopeService> logger) |
| | | 16 | | { |
| | 33 | 17 | | _permissions = permissions; |
| | 33 | 18 | | _logger = logger; |
| | 33 | 19 | | } |
| | | 20 | | |
| | | 21 | | public async Task<IQueryable<T>> ApplyDataScopeAsync<T>( |
| | | 22 | | IQueryable<T> query, |
| | | 23 | | string userId, |
| | | 24 | | string entityName, |
| | | 25 | | IDictionary<string, object?>? extraParameters = null, |
| | | 26 | | CancellationToken ct = default) |
| | | 27 | | { |
| | 24 | 28 | | if (string.IsNullOrWhiteSpace(userId)) return query; |
| | | 29 | | |
| | 18 | 30 | | var bundle = await _permissions.GetUserPermissionsAsync(userId, ct); |
| | 19 | 31 | | if (bundle.IsSuperAdmin) return query; |
| | | 32 | | |
| | 17 | 33 | | var exprs = bundle.DataScopes |
| | 20 | 34 | | .Where(s => string.Equals(s.EntityName, entityName, StringComparison.OrdinalIgnoreCase)) |
| | 18 | 35 | | .Select(s => s.FilterExpression) |
| | 18 | 36 | | .Where(s => !string.IsNullOrWhiteSpace(s)) |
| | 17 | 37 | | .ToList(); |
| | | 38 | | |
| | 20 | 39 | | if (exprs.Count == 0) return query; |
| | | 40 | | |
| | 29 | 41 | | var combined = string.Join(" OR ", exprs.Select(e => $"({e})")); |
| | | 42 | | |
| | | 43 | | try |
| | | 44 | | { |
| | 14 | 45 | | var paramNames = new List<string> { AuthorizationConstants.UserIdParameter, AuthorizationConstants.UserNameP |
| | 14 | 46 | | var paramValues = new List<object?> { userId, userId }; |
| | | 47 | | |
| | 14 | 48 | | if (extraParameters is not null) |
| | | 49 | | { |
| | 6 | 50 | | foreach (var kv in extraParameters) |
| | | 51 | | { |
| | 2 | 52 | | paramNames.Add(kv.Key); |
| | 2 | 53 | | paramValues.Add(kv.Value); |
| | | 54 | | } |
| | | 55 | | } |
| | | 56 | | |
| | 14 | 57 | | var parsingConfig = new ParsingConfig { }; |
| | 14 | 58 | | combined = SubstitutePositional(combined, paramNames); |
| | | 59 | | |
| | 14 | 60 | | return query.Where(parsingConfig, combined, paramValues.ToArray()); |
| | | 61 | | } |
| | 3 | 62 | | catch (Exception ex) |
| | | 63 | | { |
| | 3 | 64 | | _logger.LogError(ex, "Не удалось применить DataScope для пользователя {UserId}, сущность {Entity}: {Expr}", |
| | | 65 | | // fail-closed: если фильтр сломан, возвращаем пустой результат (безопаснее чем вернуть всё) |
| | 3 | 66 | | return query.Where("1 == 0"); |
| | | 67 | | } |
| | 21 | 68 | | } |
| | | 69 | | |
| | | 70 | | public string? ValidateExpression<T>(string expression) |
| | | 71 | | { |
| | 15 | 72 | | if (string.IsNullOrWhiteSpace(expression)) return "Выражение пустое"; |
| | | 73 | | try |
| | | 74 | | { |
| | 9 | 75 | | var paramNames = new[] { AuthorizationConstants.UserIdParameter, AuthorizationConstants.UserNameParameter }; |
| | 9 | 76 | | var substituted = SubstitutePositional(expression, paramNames.ToList()); |
| | 9 | 77 | | var q = Array.Empty<T>().AsQueryable(); |
| | 27 | 78 | | _ = q.Where(substituted, paramNames.Select(_ => (object?)"test").ToArray()); |
| | 6 | 79 | | return null; |
| | | 80 | | } |
| | | 81 | | catch (Exception ex) |
| | | 82 | | { |
| | 3 | 83 | | return ex.Message; |
| | | 84 | | } |
| | 9 | 85 | | } |
| | | 86 | | |
| | | 87 | | /// <summary> |
| | | 88 | | /// Преобразует «@paramName» в позиционные плейсхолдеры Dynamic LINQ («@0», «@1», …). |
| | | 89 | | /// </summary> |
| | | 90 | | private static string SubstitutePositional(string expression, IList<string> paramNames) |
| | | 91 | | { |
| | 142 | 92 | | for (int i = 0; i < paramNames.Count; i++) |
| | 48 | 93 | | expression = expression.Replace("@" + paramNames[i], "@" + i); |
| | 23 | 94 | | return expression; |
| | | 95 | | } |
| | | 96 | | } |