C# IPrincipal.IsInAnyRole方法代码示例

        internal static IQueryable<Agreement> VisibleTo(this IQueryable<Agreement> agreements, IPrincipal principal, IEnumerable<int> ownedTenantIds)
        {
            if (agreements == null) return null;
            if (principal == null) throw new ArgumentNullException("principal");
            if (ownedTenantIds == null) throw new ArgumentNullException("ownedTenantIds");

            // when user is not an agreement admin, filter out private agreements
            // and protected agreements that the user does not own
            if (!principal.IsInAnyRole(RoleName.AgreementManagers))
            {
                return agreements.Where(x => Public.Equals(x.VisibilityText, StringComparison.OrdinalIgnoreCase)
                    || (
                        Protected.Equals(x.VisibilityText, StringComparison.OrdinalIgnoreCase)
                        &&
                        x.Participants.Any(y => y.IsOwner && ownedTenantIds.Contains(y.EstablishmentId))
                    )
                );
            }

            // when user is an agreement admin, include all agreements they own
            return agreements.Where(x => Public.Equals(x.VisibilityText, StringComparison.OrdinalIgnoreCase)
                || (
                    x.Participants.Any(y => y.IsOwner && ownedTenantIds.Contains(y.EstablishmentId))
                )
            );
        }

        internal static void ApplySecurity(this Agreement agreement, IPrincipal principal, IEnumerable<int> ownedTenantIds)
        {
            if (agreement == null) return;
            if (principal == null) throw new ArgumentNullException("principal");

            // determine whether user has public, protected, or private visibility for this agreement
            var userVisibility = AgreementVisibility.Public;
            if (ownedTenantIds != null)
            {
                // user has protected visibility when they own an agreement owner
                var owningParticipantIds = agreement.Participants.Where(x => x.IsOwner).Select(x => x.EstablishmentId);
                if (ownedTenantIds.Any(owningParticipantIds.Contains))
                    userVisibility = AgreementVisibility.Protected;

                // user has private visiblity when they have protected visibility and are in an agreement manager role
                if (userVisibility == AgreementVisibility.Protected && principal.IsInAnyRole(RoleName.AgreementManagers))
                    userVisibility = AgreementVisibility.Private;
            }

            const string privateData = "[Private Data]";
            switch (userVisibility)
            {
                case AgreementVisibility.Public:
                    // when user is public and agreement is not public, something went wrong
                    if (agreement.Visibility != AgreementVisibility.Public)
                        throw new InvalidOperationException(string.Format(
                            "User '{0}' is not authorized to view this agreement.", principal.Identity.Name));

                    // when user is public and agreement is public, obfuscate protected & private data
                    agreement.Notes = privateData;
                    agreement.IsAutoRenew = null;
                    agreement.ExpiresOn = DateTime.MinValue;
                    agreement.IsExpirationEstimated = false;
                    agreement.Status = privateData;
                    agreement.Contacts = new Collection<AgreementContact>();
                    agreement.Files = new Collection<AgreementFile>();
                    break;

                case AgreementVisibility.Protected:
                    // when user is protected and agreement is private, something went wrong
                    if (agreement.Visibility == AgreementVisibility.Private)
                        throw new InvalidOperationException(string.Format(
                            "User '{0}' is not authorized to view this agreement.", principal.Identity.Name));

                    // when user is protected and agreement is not private, hide private data
                    agreement.Status = privateData;
                    agreement.Notes = privateData;
                    break;
            }
        }

        /// <summary>
        /// Claim responsibility for a task. The task to status will be set to 'Reserved'
        /// The claimant must be in the list of Potential Owners or Business Administrators.
        /// The Actual owner will be set to Claimant
        /// </summary>
        /// <param name="task">The task.</param>
        /// <param name="principal">The principal.</param>
        /// <exception cref="TaskAccessException"/>
        /// <exception cref="TaskInvalidStateException"/>
        public virtual void Claim(TaskEntity task, IPrincipal principal)
        {
            if (task.Status != TaskStatus.Ready)
                throw new TaskInvalidStateException();

            if (principal.IsInAnyRole(HumanRoles.PotentialOwner, HumanRoles.BusinessAdministrator))
            {
                task.Status = TaskStatus.Reserved;
                task.ActualOwner = principal.Identity;
            }
            else
            {
                throw new TaskAccessException();
            }
        }

        internal static IQueryable<AgreementContact> VisibleTo(this IQueryable<AgreementContact> contacts, IPrincipal principal, IEnumerable<int> ownedTenantIds)
        {
            if (contacts == null) return null;
            if (principal == null) throw new ArgumentNullException("principal");
            if (ownedTenantIds == null) throw new ArgumentNullException("ownedTenantIds");

            // when user is not an agreement admin, filter out contacts attached to private agreements
            // and protected agreements that the user does not own
            if (!principal.IsInAnyRole(RoleName.AgreementManagers))
            {
                // user must always own the agreement in order to view contacts
                return contacts.Where(x => x.Agreement.Participants.Any(y => y.IsOwner && ownedTenantIds.Contains(y.EstablishmentId))
                    && ( // additionally, the agreemnent must be public or protected
                        Public.Equals(x.Agreement.VisibilityText, StringComparison.OrdinalIgnoreCase)
                        ||
                        Protected.Equals(x.Agreement.VisibilityText, StringComparison.OrdinalIgnoreCase)
                    )
                );
            }

            // when user is an agreement admin, include all contacts attached to agreements they own
            return contacts.Where(x => x.Agreement.Participants.Any(y => y.IsOwner && ownedTenantIds.Contains(y.EstablishmentId)));
        }

 /// <summary>
 /// Suspend the task until to a given date.
 /// This action can be performed by  Potential Owners(only if the task in 'Ready' state),
 /// an Actual Owner, or a Business Administrator
 /// </summary>
 /// <param name="task">The Task Entity</param>
 /// <param name="nextTime">The next time.</param>
 /// <param name="principal">The principal.</param>
 /// <exception cref="TaskAccessException"/>
 /// <exception cref="TaskInvalidStateException"/>
 public virtual void SuspendUntil(TaskEntity task, DateTime nextTime, IPrincipal principal)
 {
     switch (task.Status)
     {
         case TaskStatus.Ready:
             if (!principal.IsInAnyRole(HumanRoles.ActualOwner, HumanRoles.PotentialOwner, HumanRoles.BusinessAdministrator))
                 throw new TaskAccessException();
             break;
         case TaskStatus.Reserved:
             if (!principal.IsInAnyRole(HumanRoles.ActualOwner, HumanRoles.BusinessAdministrator))
                 throw new TaskAccessException();
             break;
         case TaskStatus.InProgress:
             if (!principal.IsInAnyRole(HumanRoles.ActualOwner, HumanRoles.BusinessAdministrator))
                 throw new TaskAccessException();
             break;
         default:
             throw new TaskInvalidStateException();
     }
     TaskStatus oldStatus = task.Status;
     task.Status = TaskStatus.Suspended;
     task.SuspendedState = new SuspendedState
     {
         OriginalOwner = task.ActualOwner.GetMappedId(),
         OriginalStatus = oldStatus,
         OperationPerformed = DateTime.UtcNow,
         SuspensionEnds = nextTime
     };
 }

 /// <summary>
 /// Stops the task. Cancel/stop the processing of the task. The task returns to the 'Reserved' state.
 /// This action can be performed by an Actual Owner or a Business Administrator
 /// <exception cref="TaskAccessException"/>
 /// <exception cref="TaskInvalidStateException"/>
 /// </summary>
 public virtual void Stop(TaskEntity task, IPrincipal principal)
 {
     if (task.Status != TaskStatus.InProgress)
         throw new TaskInvalidStateException();
     if (!principal.IsInAnyRole(HumanRoles.ActualOwner, HumanRoles.BusinessAdministrator))
         throw new TaskAccessException();
     task.Status = TaskStatus.Reserved;
 }

 /// <summary>
 /// Skips the task. This action will be successfull only if the task is Skippable.
 /// This action can be performed by an Actual Owner, a Business Administrator, or Task initiator
 /// <exception cref="TaskAccessException"/>
 /// 	<exception cref="TaskInvalidStateException"/>
 /// </summary>
 /// <param name="task">The task.</param>
 /// <param name="principal">The principal.</param>
 public virtual void Skip(TaskEntity task, IPrincipal principal)
 {
     if (!task.IsSkippable)
         throw new TaskInvalidStateException();
     if (!principal.IsInAnyRole(HumanRoles.ActualOwner, HumanRoles.BusinessAdministrator, HumanRoles.Initiator))
         throw new TaskAccessException();
     task.Status = TaskStatus.Completed;
     task.Completed = DateTime.UtcNow;
 }

 /// <summary>
 /// Resumes the suspended task.
 /// The task status will be set to the value that the task had before 'Suspend' action was called.
 /// This action can be performed by  Potential Owners(only if the task in 'Ready' state),
 /// an Actual Owner, or a Business Administrator
 /// </summary>
 /// <param name="task">The task.</param>
 /// <param name="principal">The principal.</param>
 /// <exception cref="TaskAccessException"/>
 /// <exception cref="TaskInvalidStateException"/>
 public virtual void Resume(TaskEntity task, IPrincipal principal)
 {
     if (task.Status != TaskStatus.Suspended || task.SuspendedState == null)
         throw new TaskInvalidStateException();
     if (principal.IsInAnyRole(HumanRoles.ActualOwner, HumanRoles.BusinessAdministrator) ||
         ((principal.IsInRole(HumanRoles.PotentialOwner) && task.SuspendedState.OriginalStatus == TaskStatus.Ready)))
     {
         task.Status = task.SuspendedState.OriginalStatus;
         task.SuspendedState = null;
     }
     else
     {
         throw new TaskAccessException();
     }
 }

 /// <summary>
 /// Forwards this instance.
 /// This action can be performed by an Actual Owner, a Business Administrator,
 /// or a Potential Owner (if the task is in 'Ready' state
 /// <exception cref="TaskAccessException"/>
 /// 	<exception cref="TaskInvalidStateException"/>
 /// </summary>
 /// <param name="task">The task entity</param>
 /// <param name="target">The target identity ( a person or a group) .</param>
 /// <param name="principal">The principal.</param>
 public virtual void Forward(TaskEntity task, IIdentity target, IPrincipal principal)
 {
     switch (task.Status)
     {
         case TaskStatus.Ready:
             if (principal.IsInAnyRole(HumanRoles.ActualOwner, HumanRoles.PotentialOwner,
                 HumanRoles.BusinessAdministrator))
             {
                 ExecuteForward(task, target);
             }
             else
             {
                 throw new TaskAccessException();
             }
             break;
         case TaskStatus.Reserved:
         case TaskStatus.InProgress:
             if (principal.IsInAnyRole(HumanRoles.ActualOwner, HumanRoles.BusinessAdministrator))
             {
                 ExecuteForward(task, target);
             }
             else
             {
                 throw new TaskAccessException();
             }
             break;
         default:
             throw new TaskInvalidStateException();
     }
 }

 /// <summary>
 /// Delegates the task.
 /// Assign the task to a target user and set the task status to 'Reserved'.
 /// If the recipient was not a potential owner then this
 /// person will be added to the list of potential owners.
 /// </summary>
 /// <param name="task">The task entity</param>
 /// <param name="target">The target user.</param>
 /// <param name="priority">The priority.</param>
 /// <param name="principal">The principal.</param>
 public virtual void Delegate(TaskEntity task, IIdentity target, Priority priority, IPrincipal principal)
 {
     if (task.Status != TaskStatus.InProgress)
         throw new TaskInvalidStateException();
     if (!principal.IsInAnyRole(HumanRoles.ActualOwner, HumanRoles.BusinessAdministrator))
         throw new TaskAccessException();
     task.Status = TaskStatus.Reserved;
     if (target.IsGroupIdentity())
         throw new ArgumentException("Cannot delegate a task to a group!");
     task.ActualOwner = target;
     task.Priority = priority;
 }