Role Manager

Author: MWClayson-NHS

application/CohortManager/src/Functions/Shared/Common/Authentication/IRoleManager.cs

@@ -0,0 +1,6 @@
+namespace Common;
+
+public interface IRoleManager
+{
+    public bool ValidateRole(Cis2User user, Role role);
+}

…ared/Common/Authentication/RoleMapper.cs …red/Common/Authentication/RoleManager.csapplication/CohortManager/src/Functions/Shared/Common/Authentication/RoleMapper.cs renamed to application/CohortManager/src/Functions/Shared/Common/Authentication/RoleManager.cs application/CohortManager/src/Functions/Shared/Common/Authentication/RoleMapper.cs renamed to application/CohortManager/src/Functions/Shared/Common/Authentication/RoleManager.cs

@@ -2,12 +2,12 @@ namespace Common;
 
 using Microsoft.Extensions.Options;
 
-public class RoleMapper
+public class RoleManager : IRoleManager
 {
     private readonly Dictionary<string, Role> _roleMappings;
 
     IOptions<RoleConfig> _roleConfig;
-    public RoleMapper(IOptions<RoleConfig> roleConfig)
+    public RoleManager(IOptions<RoleConfig> roleConfig)
     {
         _roleConfig = roleConfig;
         _roleMappings = new Dictionary<string, Role>
@@ -16,9 +16,16 @@ public RoleMapper(IOptions<RoleConfig> roleConfig)
             { _roleConfig.Value.CohortManagerDummyGpRemovalWorkgroupId, Role.CohortManagerDummyGpRemoval }
         };
     }
-
-    public Role? GetRole(string workgroupId)
+    public bool ValidateRole(Cis2User user, Role role)
     {
-        return _roleMappings.TryGetValue(workgroupId, out var mappedRole) ? mappedRole : null;
+
+        var workgroupId = _roleMappings.FirstOrDefault(x => x.Value == role).Key;
+
+        if (workgroupId == null)
+        {
+            return false;
+        }
+        return user.NhsidNrbacRoles.Count(x => x.WorkgroupsCodes.Contains(workgroupId)) > 0;
     }
+
 }

…ons/Shared/Common/Authentication/Role.cs …hared/Common/Authentication/RolesEnum.csapplication/CohortManager/src/Functions/Shared/Common/Authentication/Role.cs renamed to application/CohortManager/src/Functions/Shared/Common/Authentication/RolesEnum.cs application/CohortManager/src/Functions/Shared/Common/Authentication/Role.cs renamed to application/CohortManager/src/Functions/Shared/Common/Authentication/RolesEnum.cs

@@ -9,6 +9,7 @@ public static IHostBuilder AddAuthentication(this IHostBuilder hostBuilder)
     {
 
         hostBuilder.AddConfiguration<AuthConfig>();
+        hostBuilder.AddConfiguration<RoleConfig>();
         hostBuilder.ConfigureFunctionsWorkerDefaults(workerOptions =>
         {
             workerOptions.UseMiddleware<Cis2AuthMiddleware>();
@@ -17,6 +18,7 @@ public static IHostBuilder AddAuthentication(this IHostBuilder hostBuilder)
         {
             services.AddSingleton<IAuthenticationService, JwtAuthentication>();
             services.AddSingleton<ICis2UserService,Cis2UserService>();
+            services.AddSingleton<IRoleManager, RoleManager>();
         });
         return hostBuilder;
      }

application/CohortManager/src/Functions/Shared/Common/Extensions/AuthenticationExtension.cs

@@ -24,14 +24,16 @@ public class GetValidationExceptions
     private readonly IValidationExceptionData _validationData;
     private readonly IHttpParserHelper _httpParserHelper;
     private readonly IPaginationService<ValidationException> _paginationService;
+    private readonly IRoleManager _roleManager;
 
-    public GetValidationExceptions(ILogger<GetValidationExceptions> logger, ICreateResponse createResponse, IValidationExceptionData validationData, IHttpParserHelper httpParserHelper, IPaginationService<ValidationException> paginationService)
+    public GetValidationExceptions(ILogger<GetValidationExceptions> logger, ICreateResponse createResponse, IValidationExceptionData validationData, IHttpParserHelper httpParserHelper, IPaginationService<ValidationException> paginationService, IRoleManager roleManager)
     {
         _logger = logger;
         _createResponse = createResponse;
         _validationData = validationData;
         _httpParserHelper = httpParserHelper;
         _paginationService = paginationService;
+        _roleManager = roleManager;
     }
 
     /// <summary>
@@ -57,6 +59,12 @@ public async Task<HttpResponseData> Run([HttpTrigger(AuthorizationLevel.Anonymou
         var isReport = _httpParserHelper.GetQueryParameterAsBool(req, "isReport");
         var ruleId = _httpParserHelper.GetQueryParameterAsNullableInt(req, "ruleId");
         var dateCreated = _httpParserHelper.GetQueryParameterAsDateTime(req, "dateCreated");
+
+        if (!_roleManager.ValidateRole((Cis2User)req.FunctionContext.Items["Cis2User"]!, Role.CohortManagerUser))
+        {
+            return _createResponse.CreateHttpResponse(HttpStatusCode.Forbidden, req);
+        }
+
         try
         {
             if (exceptionId > 0)