Handling Authorization and Role-Based Access Control (RBAC)

public class Page : BaseEntity
{
    public required string Name { get; set; }
    public required string Url { get; set; }
    public int PageOrder { get; set; }
}

public class Operation : BaseEntity
{
    public required string Name { get; set; }
    public required string Description { get; set; }
}

public class Permission : BaseEntity
{
    public Guid PageId { get; set; }
    public Guid OperationId { get; set; }
    public required string Description { get; set; }
}

public class Role : BaseEntity
{
    public required string Name { get; set; }
    public required string Description { get; set; }
}

public class RolePermission : BaseEntity
{
    public Guid RoleId { get; set; }
    public Guid PermissionId { get; set; }
}

public class UserRole : BaseEntity
{
    public Guid UserId { get; set; }
    public Guid RoleId { get; set; }
}

using Microsoft.AspNetCore.Authorization;

namespace Contact.Api.Core.Authorization;

public class AuthorizePermissionAttribute : AuthorizeAttribute
{
    public AuthorizePermissionAttribute(string permission)
    {
        // Converts "Contacts.Create" to "Contacts.CreatePolicy"
        Policy = $"{permission}Policy";
    }
}

[HttpPost]
[ActivityLog("Creating new Contact")]
[AuthorizePermission("Contacts.Create")]
public async Task<IActionResult> Add(CreateContactPerson createContactPerson)
{
    var createdContactPerson = await _contactPersonService.Add(createContactPerson);
    return CreatedAtAction(nameof(GetById), new { id = createdContactPerson.Id }, createdContactPerson);
}

[HttpPut("{id}")]
[ActivityLog("Updating existing Contact")]
[AuthorizePermission("Contacts.Update")]
public async Task<IActionResult> Update(Guid id, UpdateContactPerson updateContactPerson)
{
    await _contactPersonService.Update(id, updateContactPerson);
    return NoContent();
}

[HttpDelete("{id}")]
[ActivityLog("Deleting existing Contact")]
[AuthorizePermission("Contacts.Delete")]
public async Task<IActionResult> Delete(Guid id)
{
    await _contactPersonService.Delete(id);
    return NoContent();
}

[HttpGet]
[AuthorizePermission("Contacts.Read")]
public async Task<IActionResult> Get()
{
    var contactPersons = await _contactPersonService.GetAll();
    return Ok(contactPersons);
}

using Microsoft.AspNetCore.Authorization;

namespace Contact.Api.Core.Authorization;

public class PermissionRequirement : IAuthorizationRequirement
{
    public string Permission { get; }

    public PermissionRequirement(string permission)
    {
        Permission = permission;
    }
}

using Microsoft.AspNetCore.Authorization;
using Microsoft.Extensions.Options;

namespace Contact.Api.Core.Authorization;

public class CustomAuthorizationPolicyProvider : IAuthorizationPolicyProvider
{
    private readonly DefaultAuthorizationPolicyProvider _fallbackPolicyProvider;

    public CustomAuthorizationPolicyProvider(IOptions<AuthorizationOptions> options)
    {
        _fallbackPolicyProvider = new DefaultAuthorizationPolicyProvider(options);
    }

    public Task<AuthorizationPolicy?> GetPolicyAsync(string policyName)
    {
        // Check if this is a permission-based policy (ends with "Policy")
        if (policyName.EndsWith("Policy"))
        {
            // Dynamically create a policy with PermissionRequirement
            var policy = new AuthorizationPolicyBuilder()
                .AddRequirements(new PermissionRequirement(policyName))
                .Build();
            return Task.FromResult<AuthorizationPolicy?>(policy);
        }

        // Fall back to default policy provider for non-permission policies
        return _fallbackPolicyProvider.GetPolicyAsync(policyName);
    }

    public Task<AuthorizationPolicy> GetDefaultPolicyAsync()
    {
        return _fallbackPolicyProvider.GetDefaultPolicyAsync();
    }

    public Task<AuthorizationPolicy?> GetFallbackPolicyAsync()
    {
        return _fallbackPolicyProvider.GetFallbackPolicyAsync();
    }
}

using Contact.Application.Interfaces;
using Microsoft.AspNetCore.Authorization;

namespace Contact.Api.Core.Authorization;

public class PermissionHandler : AuthorizationHandler<PermissionRequirement>
{
    private readonly IServiceProvider _serviceProvider;

    public PermissionHandler(IServiceProvider serviceProvider)
    {
        _serviceProvider = serviceProvider;
    }

    protected override async Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        PermissionRequirement requirement)
    {
        // Create a scope to resolve scoped services
        using var scope = _serviceProvider.CreateScope();
        var userService = scope.ServiceProvider.GetRequiredService<IUserService>();
        var rolePermissionService = scope.ServiceProvider.GetRequiredService<IRolePermissionService>();

        // Check if user is authenticated
        if (context.User.Identity?.IsAuthenticated != true)
        {
            return; // Not authenticated, don't succeed
        }

        // Get user's roles from JWT claims
        var roles = await userService.GetUserRolesAsync(context.User);

        // Get all role-permission mappings from database
        var rolePermissionMappings = await rolePermissionService.GetRolePermissionMappingsAsync();

        // Build list of permissions for user's roles
        // Format: "PageName.OperationNamePolicy" (e.g., "Contacts.CreatePolicy")
        var userPermissions = rolePermissionMappings
            .Where(rpm => roles.Contains(rpm.RoleName))
            .Select(rpm => $"{rpm.PageName}.{rpm.OperationName}Policy");

        // Check if user has the required permission
        if (userPermissions.Contains(requirement.Permission))
        {
            context.Succeed(requirement);
        }
    }
}

// Add the custom policy provider
builder.Services.AddSingleton<IAuthorizationPolicyProvider, CustomAuthorizationPolicyProvider>();

// Add the permission handler
builder.Services.AddScoped<IAuthorizationHandler, PermissionHandler>();

// Configure JWT authentication
builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = builder.Configuration["Jwt:Issuer"],
        ValidAudience = builder.Configuration["Jwt:Audience"],
        IssuerSigningKey = new SymmetricSecurityKey(
            Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Secret"]!))
    };
});

public async Task<AuthenticateResponse?> Authenticate(AuthenticateRequest model)
{
    // Find user by email
    var user = await _userRepository.GetUserByEmail(model.Email);

    if (user == null) return null;

    // Verify password
    if (!BCrypt.Net.BCrypt.Verify(model.Password, user.Password))
        return null;

    // Generate JWT token with role claims
    var token = GenerateJwtToken(user);

    // Get all role permissions for this user
    var rolePermissions = await GetRolePermissionMappingsAsync(user.Id);

    // Return response with token AND permissions
    return new AuthenticateResponse(user, token, rolePermissions.ToList());
}

private string GenerateJwtToken(User user)
{
    var tokenHandler = new JwtSecurityTokenHandler();
    var key = Encoding.ASCII.GetBytes(_appSettings.Secret);

    // Create claims including user roles
    var claims = new List<Claim>
    {
        new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
        new Claim(ClaimTypes.Email, user.Email),
        new Claim(ClaimTypes.Name, user.Username)
    };

    // Add role claims (used by PermissionHandler)
    var roles = _userRoleRepository.GetUserRolesAsync(user.Id).Result;
    foreach (var role in roles)
    {
        claims.Add(new Claim(ClaimTypes.Role, role.Name));
    }

    var tokenDescriptor = new SecurityTokenDescriptor
    {
        Subject = new ClaimsIdentity(claims),
        Expires = DateTime.UtcNow.AddDays(7),
        SigningCredentials = new SigningCredentials(
            new SymmetricSecurityKey(key),
            SecurityAlgorithms.HmacSha256Signature),
        Issuer = _appSettings.Issuer,
        Audience = _appSettings.Audience
    };

    var token = tokenHandler.CreateToken(tokenDescriptor);
    return tokenHandler.WriteToken(token);
}

import { Routes } from '@angular/router';
import { permissionGuard } from '@core/guards/permission.guard';

export const CONTACT_ROUTES: Routes = [
  {
    path: '',
    component: ContactListComponent,
    canActivate: [permissionGuard('Contacts', 'Read')]
  },
  {
    path: 'add',
    component: ContactFormComponent,
    canActivate: [permissionGuard('Contacts', 'Create')]
  },
  {
    path: 'edit/:id',
    component: ContactFormComponent,
    canActivate: [permissionGuard('Contacts', 'Update')]
  }
];

import { Component, OnInit, inject, signal } from '@angular/core';
import { RolePermissionService } from '@core/services/role-permission.service';
import { RoleService } from '@core/services/role.service';
import { PermissionService as AdminPermissionService } from '@core/services/admin-permission.service';
import { NotificationService } from '@core/services/notification.service';

interface PageWithOperations {
  pageId: string;
  pageName: string;
  expanded: boolean;
  operations: OperationPermission[];
}

interface OperationPermission {
  operationId: string;
  operationName: string;
  permissionId: string;
  isSelected: boolean;
}

@Component({
  selector: 'app-role-permission-mapping',
  templateUrl: './role-permission-mapping.component.html',
  standalone: true,
  // ... imports
})
export class RolePermissionMappingComponent implements OnInit {
  private roleService = inject(RoleService);
  private permissionService = inject(AdminPermissionService);
  private rolePermissionService = inject(RolePermissionService);
  private notificationService = inject(NotificationService);

  // State using signals
  roles = signal<Role[]>([]);
  selectedRoleId = signal<string>('');
  pages = signal<PageWithOperations[]>([]);
  loading = signal<boolean>(false);

  ngOnInit(): void {
    this.loadRoles();
  }

  async loadRoles(): Promise<void> {
    this.roleService.getRoles().subscribe({
      next: (roles) => this.roles.set(roles),
      error: (err) => this.notificationService.error('Failed to load roles')
    });
  }

  onRoleChange(roleId: string): void {
    this.selectedRoleId.set(roleId);
    this.loadPermissionsForRole(roleId);
  }

  async loadPermissionsForRole(roleId: string): Promise<void> {
    this.loading.set(true);

    // Get all permissions grouped by page
    this.permissionService.getPermissionsGroupedByPage().subscribe({
      next: (groupedPermissions) => {
        // Get current role's permissions
        this.rolePermissionService.getRolePermissions(roleId).subscribe({
          next: (rolePermissions) => {
            // Mark which permissions are selected for this role
            const pages = groupedPermissions.map(page => ({
              ...page,
              expanded: false,
              operations: page.operations.map(op => ({
                ...op,
                isSelected: rolePermissions.some(rp => rp.permissionId === op.permissionId)
              }))
            }));
            this.pages.set(pages);
            this.loading.set(false);
          }
        });
      }
    });
  }

  togglePage(pageIndex: number): void {
    const pages = [...this.pages()];
    pages[pageIndex].expanded = !pages[pageIndex].expanded;
    this.pages.set(pages);
  }

  togglePermission(pageIndex: number, opIndex: number): void {
    const pages = [...this.pages()];
    pages[pageIndex].operations[opIndex].isSelected =
      !pages[pageIndex].operations[opIndex].isSelected;
    this.pages.set(pages);
  }

  savePermissions(): void {
    const roleId = this.selectedRoleId();

    // Collect all selected permission IDs
    const selectedPermissionIds = this.pages()
      .flatMap(page => page.operations)
      .filter(op => op.isSelected)
      .map(op => op.permissionId);

    const payload = {
      roleId: roleId,
      permissionIds: selectedPermissionIds
    };

    this.rolePermissionService.saveRolePermissions(payload).subscribe({
      next: () => {
        this.notificationService.success('Permissions saved successfully');
      },
      error: (err) => {
        this.notificationService.error('Failed to save permissions');
      }
    });
  }
}