MediatR.Behaviors.Authorization
A simple request authorization package that allows you to build and run request specific authorization requirements before your request handler is called. You can read my article on the reasoning for this library for further analysis.
Installation
Using the .NET Core command-line interface (CLI) tools:
dotnet add package MediatR.Behaviors.Authorization
Using the NuGet Command Line Interface (CLI):
nuget install MediatR.Behaviors.Authorization
Using the Package Manager Console:
Install-Package MediatR.Behaviors.Authorization
From within Visual Studio:
- Open the Solution Explorer.
- Right-click on a project within your solution.
- Click on Manage NuGet Packages...
- Click on the Browse tab and search for "MediatR.Behaviors.Authorization".
- Click on the MediatR.Behaviors.Authorization package, select the latest version in the right-tab and click Install.
Getting Started
Dependency Injection
You will need to register the authorization pipeline along with all implementations of IAuthorizer
:
using MediatR.Behaviors.Authorization.Extensions.DependencyInjection;
public class Startup
{
//...
public void ConfigureServices(IServiceCollection services)
{
// Add the transient pipeline behavior
services.AddMediatorAuthorization();
// Register all `IAuthorizer` implementations for a given assembly
services.AddAuthorizersFromAssembly(Assembly.GetExecutingAssembly())
}
}
You can use the helper method to register 'IAuthorizer' implementations from an assembly or manually inject them using Microsoft's DI methods.
Example Usage
Scenario: We need to get details about a specific video for a course on behalf of a user. However, this video course information is considered privileged information and we only want users with a subscription to that course to have access to the information about the video.
IAuthorizationRequirement
Creating an Authorization Requirement Location: ~/Application/Authorization/MustHaveCourseSubscriptionRequirement.cs
You can create custom, reusable authorization rules for your MediatR requests by implementing IAuthorizationRequirement
and IAuthorizationHandler<TAuthorizationRequirement>
:
public class MustHaveCourseSubscriptionRequirement : IAuthorizationRequirement
{
public string UserId { get; set; }
public int CourseId { get; set; }
class MustHaveCourseSubscriptionRequirementHandler : IAuthorizationHandler<MustHaveCourseSubscriptionRequirement>
{
private readonly IApplicationDbContext _applicationDbContext;
public MustHaveCourseSubscriptionRequirementHandler(IApplicationDbContext applicationDbContext)
{
_applicationDbContext = applicationDbContext;
}
public async Task<AuthorizationResult> Handle(MustHaveCourseSubscriptionRequirement request, CancellationToken cancellationToken)
{
var userId = request.UserId;
var userCourseSubscription = await _applicationDbContext.UserCourseSubscriptions
.FirstOrDefaultAsync(x => x.UserId == userId && x.CourseId == request.CourseId, cancellationToken);
if (userCourseSubscription != null)
return AuthorizationResult.Succeed();
return AuthorizationResult.Fail("You don't have a subscription to this course.");
}
}
}
In the preceding listing, you can see this is your standard MediatR Request/Request Handler usage; so you can treat the whole affair as you normally would. It is important to note you must return AuthorizationResult
You can fail two ways: AuthorizationResult.Fail()
or AuthorizationResult.Fail("your message here")
and you can pass using AuthorizationResult.Succeed()
Basic MediatR Request
Location: ~/Application/Courses/Queries/GetCourseVideoDetail/GetCourseVideoDetailQuery.cs
public class GetCourseVideoDetailQuery : IRequest<CourseVideoDetailVm>
{
public int CourseId { get; set; }
public int VideoId { get; set; }
class GetCourseVideoDetailQueryHandler : IRequestHandler<GetCourseVideoDetailQuery>
{
private readonly IApplicationDbContext _applicationDbContext;
public GetCourseVideoDetailQueryHandler(IApplicationDbContext applicationDbContext)
{
_applicationDbContext = applicationDbContext;
}
public async Task<CourseVideoDetailVm> Handle(GetCourseVideoDetailQuery request, CancellationToken cancellationToken)
{
var video = await _applicationDbContext.CourseVideos
.FirstOrDefaultAsync(x => x.CourseId == request.CourseId && x.VideoId == request.VideoId, cancellationToken);
return new CourseVideoDetailVm(video);
}
}
}
IAuthorizer
Creating the Location: ~/Application/Courses/Queries/GetCourseVideoDetail/GetCourseVideoDetailAuthorizer.cs
public class GetCourseVideoDetailAuthorizer : AbstractRequestAuthorizer<GetCourseVideoDetailQuery>
{
private readonly ICurrentUserService _currentUserService;
public GetCourseVideoDetailAuthorizer(ICurrentUserService currentUserService)
{
_currentUserService = currentUserService;
}
public override void BuildPolicy(GetCourseVideoDetailQuery request)
{
UseRequirement(new MustHaveCourseSubscriptionRequirement
{
CourseId = request.CourseId,
UserId = _currentUserService.UserId
});
}
}
The usage of AbstractRequestAuthorizer<TRequest>
will usually be preferable; this abstract class does a couple things for us. It takes care of initializing and adding new requirements to the Requirements
property through the UseRequirement(IAuthorizationRequirement)
, finally, it still forces the class extending it to implement the IAuthorizer.BuildPolicy()
method which is very important for passing the needed arguments to the authorization requirement that handles the authorization logic.
For any requests, bug or comments, please open an issue or submit a pull request.