permissions bypass

Author: MWClayson-NHS

application/CohortManager/src/Functions/Shared/Common/Authentication/CIS2AuthMiddleware.cs

@@ -1,10 +1,12 @@
 namespace Common;
 
 using System.Net;
+using System.Runtime.CompilerServices;
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Http;
 using Microsoft.Azure.Functions.Worker.Middleware;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 public class Cis2AuthMiddleware : IFunctionsWorkerMiddleware
 {
@@ -13,19 +15,22 @@ public class Cis2AuthMiddleware : IFunctionsWorkerMiddleware
     private readonly ICreateResponse _createResponse;
     private readonly IAuthenticationService _authService;
     private readonly ICis2UserService _cis2UserService;
+    private readonly AuthConfig _authConfig;
 
-    public Cis2AuthMiddleware(ILogger<Cis2AuthMiddleware> logger, ICreateResponse createResponse, IAuthenticationService authService, ICis2UserService cis2UserService)
+    public Cis2AuthMiddleware(ILogger<Cis2AuthMiddleware> logger, ICreateResponse createResponse, IAuthenticationService authService, ICis2UserService cis2UserService, IOptions<AuthConfig> authConfig)
     {
         _logger = logger;
         _createResponse = createResponse;
         _authService = authService;
         _cis2UserService = cis2UserService;
+        _authConfig = authConfig.Value;
     }
 
     public async Task Invoke(FunctionContext context, FunctionExecutionDelegate next)
     {
-        if(!context.RequiresAuthentication())
+        if(_authConfig.ByPassAuthentication || !context.RequiresAuthentication())
         {
+            _logger.LogInformation("Authentication is bypassed or not required for this endpoint, skipping authentication.");
             await next(context);
             return;
         }

application/CohortManager/src/Functions/Shared/Common/Authentication/Config/AuthConfig.cs

@@ -10,7 +10,7 @@ public class AuthConfig
     public required string AuthClientId { get; init; }
     [Required, Url]
     public required string UserInfoUrl { get; init; }
-    public bool RequireAuthentication { get; init; } = true;
+    public bool ByPassAuthentication { get; init; } = false;
 
 }
 

application/CohortManager/src/Functions/Shared/Common/Authentication/PermissionsMiddleware.cs

@@ -1,36 +1,52 @@
 namespace Common;
 
-
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Http;
 using Microsoft.Azure.Functions.Worker.Middleware;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 public class PermissionsMiddleware : IFunctionsWorkerMiddleware
 {
     private readonly ICreateResponse _createResponse;
     private readonly IRoleManager _roleManager;
     private readonly ILogger<PermissionsMiddleware> _logger;
+    private readonly AuthConfig _authConfig;
 
-    public PermissionsMiddleware(ICreateResponse createResponse, IRoleManager roleManager, ILogger<PermissionsMiddleware> logger)
+    public PermissionsMiddleware(ICreateResponse createResponse, IRoleManager roleManager, ILogger<PermissionsMiddleware> logger, IOptions<AuthConfig> authConfig)
     {
         _createResponse = createResponse;
         _roleManager = roleManager;
         _logger = logger;
+        _authConfig = authConfig.Value;
      }
 
     public async Task Invoke(FunctionContext context, FunctionExecutionDelegate next)
     {
+        if(_authConfig.ByPassAuthentication)
+        {
+            _logger.LogInformation("Authentication is bypassed, skipping permissions check.");
+            await next(context);
+            return;
+        }
+
         if (!context.RequiresAuthentication())
         {
+            _logger.LogInformation("No authentication required for this endpoint, skipping permissions check.");
+            await next(context);
+            return;
+        }
+        var requiredRoles = context.GetRequiredRoles();
+
+        if(requiredRoles.Length == 0)
+        {
+            _logger.LogInformation("No specific roles required for this endpoint, skipping permissions check.");
             await next(context);
             return;
         }
 
         var req = await context.GetHttpRequestDataAsync();
         var user = (Cis2User)context.Items["Cis2User"]!;
-        var requiredRoles = context.GetRequiredRoles();
-
         if (requiredRoles.Length == 0 || requiredRoles.Any(role => _roleManager.ValidateRole(user, role)))
         {
             await next(context);
@@ -43,8 +59,7 @@ public async Task Invoke(FunctionContext context, FunctionExecutionDelegate next
 
     private async Task HandleUnauthorizedAsync(FunctionContext context, HttpRequestData request, string logMessage, string responseMessage)
     {
-        var logger = context.GetLogger<PermissionsMiddleware>();
-        logger.LogWarning("Authorization Error: {LogMessage}", logMessage);
+        _logger.LogWarning("Permissions Error: {LogMessage}", logMessage);
         var response = await _createResponse.CreateHttpResponseWithBodyAsync(System.Net.HttpStatusCode.Forbidden, request, responseMessage);
         context.GetInvocationResult().Value = response;
     }