mws.backend.dotnet/mws.application/Permissions/PermissionService.cs

using Mws.Application.Common;

namespace Mws.Application.Permissions;

public class PermissionService(IUnitOfWork uow) : IPermissionService
{
    public async Task<List<MenuItemDto>> GetMenuAsync(Guid userId, CancellationToken ct = default)
    {
        var roleId = await uow.Users.GetRoleIdAsync(userId, ct);
        var permissions = await uow.Roles.GetPermissionsAsync(roleId, ct);

        return ScreenCatalog.Screens.Select(s =>
        {
            permissions.TryGetValue(s.Key, out var p);
            return new MenuItemDto
            {
                Key = s.Key,
                Label = s.Label,
                Path = s.Path,
                CanView = p?.CanView ?? false,
                CanCreate = p?.CanCreate ?? false,
                CanEdit = p?.CanEdit ?? false,
                CanDelete = p?.CanDelete ?? false,
            };
        }).ToList();
    }

    public async Task EnsureAsync(Guid userId, string screen, PermissionAction action, CancellationToken ct = default)
    {
        var roleId = await uow.Users.GetRoleIdAsync(userId, ct);
        var permission = await uow.Roles.GetPermissionAsync(roleId, screen, ct);

        var allowed = action switch
        {
            PermissionAction.View => permission?.CanView ?? false,
            PermissionAction.Create => permission?.CanCreate ?? false,
            PermissionAction.Edit => permission?.CanEdit ?? false,
            PermissionAction.Delete => permission?.CanDelete ?? false,
            _ => false,
        };

        if (!allowed)
        {
            throw new ForbiddenException($"Not permitted to {action} on {screen}");
        }
    }
}