src/fursvp.domain/Authorization/WriteAuthorization/WriteAuthorizeMember.cs
/// <summary>
/// Performs the authorization check for a state change and throws an exception if the check fails.
/// </summary>
/// <param name="oldMemberState">The initial member state.</param>
/// <param name="oldEventState">The initial event state.</param>
/// <param name="newMemberState">The new member state.</param>
/// <param name="newEventState">The new event state.</param>
/// <param name="actingMember">The member performing the action.</param>
Performs the authorization check for a state change and throws an exception if the check fails.
Performs the authorization check for a state change and throws an exception if the check fails .
public void WriteAuthorize(Member oldMemberState, Event oldEventState, Member newMemberState, Event newEventState, Member actingMember)
        {
            if (actingMember?.IsAuthor == true)
            {
                return;
            }
            if (newMemberState != null)
            {
                bool targetMemberWasAuthor = oldMemberState?.IsAuthor == true;
                Assert.That(targetMemberWasAuthor == newMemberState.IsAuthor, nameof(newMemberState.IsAuthor) + " cannot be set.");
                bool targetMemberWasOrganizer = oldMemberState?.IsOrganizer == true;
                Assert.That(targetMemberWasOrganizer == newMemberState.IsOrganizer, nameof(newMemberState.IsOrganizer) + " cannot be set.");
            }
            if (oldMemberState == null && actingMember?.IsOrganizer != true)
            {
                Assert.That(EventService.RsvpOpen(newEventState), "New members cannot be added at this time.");
            }
            if (oldMemberState == null || oldMemberState == actingMember)
            {
                return;
            }
            if (actingMember?.IsOrganizer == true && !oldMemberState.IsAuthor && !oldMemberState.IsOrganizer)
            {
                return;
            }
            Assert.That(newMemberState != null, "You do not have permission to remove this member's info.");
            Contract.Requires(newMemberState != null);
            Assert.That(
                oldMemberState.EmailAddress == newMemberState.EmailAddress
                    && oldMemberState.Name == newMemberState.Name
                    && oldMemberState.IsAttending == newMemberState.IsAttending,
                "You do not have permission to change this member's info.");
            var oldResponses = oldMemberState.Responses.SelectMany(r => r.Responses.Select(response => new { r.PromptId, response }));
            var newResponses = newMemberState.Responses.SelectMany(r => r.Responses.Select(response => new { r.PromptId, response }));
            Assert.That(!oldResponses.FullJoin(newResponses, s => s, s => s, (o, i) => o == null || i == null).Any(r => r), "You do not have permission to change this member's form responses.");
        }
public void WriteAuthorize ( Member oldMemberState , Event oldEventState , Member newMemberState , Event newEventState , Member actingMember ) { if ( actingMember ? . IsAuthor == true ) { return ; } if ( newMemberState != null ) { bool targetMemberWasAuthor = oldMemberState ? . IsAuthor == true ; Assert . That ( targetMemberWasAuthor == newMemberState . IsAuthor , nameof ( newMemberState . IsAuthor ) + " " ) ; bool targetMemberWasOrganizer = oldMemberState ? . IsOrganizer == true ; Assert . That ( targetMemberWasOrganizer == newMemberState . IsOrganizer , nameof ( newMemberState . IsOrganizer ) + " " ) ; } if ( oldMemberState == null && actingMember ? . IsOrganizer != true ) { Assert . That ( EventService . RsvpOpen ( newEventState ) , " " ) ; } if ( oldMemberState == null || oldMemberState == actingMember ) { return ; } if ( actingMember ? . IsOrganizer == true && ! oldMemberState . IsAuthor && ! oldMemberState . IsOrganizer ) { return ; } Assert . That ( newMemberState != null , " " ) ; Contract . Requires ( newMemberState != null ) ; Assert . That ( oldMemberState . EmailAddress == newMemberState . EmailAddress && oldMemberState . Name == newMemberState . Name && oldMemberState . IsAttending == newMemberState . IsAttending , " " ) ; var oldResponses = oldMemberState . Responses . SelectMany ( r => r . Responses . Select ( response => new { r . PromptId , response } ) ) ; var newResponses = newMemberState . Responses . SelectMany ( r => r . Responses . Select ( response => new { r . PromptId , response } ) ) ; Assert . That ( ! oldResponses . FullJoin ( newResponses , s => s , s => s , ( o , i ) => o == null || i == null ) . Any ( r => r ) , " " ) ; }
Performs the authorization check for a state change and throws an exception if the check fails.
Performs the authorization check for a state change and throws an exception if the check fails .
// I am the event author. I am authorized to do just about anything to member records. // I am not the author. I am not allowed to change anyone's status as organizer or author, not even my own. // I'm not an author or organizer and I'm trying to add a new RSVP // I am editing my own entry or creating a new entry. I can change anything except the above. // I am an organizer changing or removing an entry that does not belong to another organizer or the author. I can change anything except the above. // I am either an organizer changing or removing another organizer or the author, or I am a member changing or removing anyone else's entry. Changes aren't allowed. // Assert that the old form responses and new form responses are equivalent.
oldMemberState
Member
The initial member state.
The initial member state .
oldEventState
Event
The initial event state.
The initial event state .
newMemberState
Member
The new member state.
The new member state .
newEventState
Event
The new event state.
The new event state .
actingMember
Member
The member performing the action.
The member performing the action .