C#•2y ago

ASP, Identity, Blazor Give Permission for delete to specific users.

In my Database i have a entity that acts like a group for multible users. There is a m:n relation between groups and users(IdentityUser) I want that only users in those groups are able to create/update/delete group related data. Like events in a scheduler or messages in the group-chat. But i can't think of a neat way to prevent other users from adding/deleting things to a group they are not part of. Right now i always get the userId in the controller and then a linq statement checks if there is a user with this Id in the group he wants to access. This feels a bit wrong because i have to make sure that nobody else gets hold of a foreign userId and it's in a different location than the default role based authorization i use.

48 Replies

Elf•2y ago

I have a problem, yesterday I was given the first test task regarding asp.net web api maybe entity framework, I had experience with entity framework before but with api for the first time. And now I'm very confused, and I don't know what to do next. I have three models, but now I don't understand how to make a connection between them. Could try to pay maybe for good help (

DeaDo•2y ago

https://www.entityframeworktutorial.net/code-first/configure-one-to-one-relationship-in-code-first.aspx

Configure One-to-One relationship in Code First Entity Framework

Learn how to configure one-to-one relationship in Entity Framework 6 code-first approach.

DeaDo•2y ago

here are some instructions in creating different relations between models u just add a property with the type of the foreign entity and when u create a migration (code-first) then the EF-Tools notices the type and creates a relation automatically u could create a new post for that though

Elf•2y ago

Oh yes, I read it, but when I started to write it, I got confused Сan i show a screenshot of the models? 😅

DeaDo•2y ago

sure u can also use 3 of those ` then your text is recognized as code and uses proper format

Elf•2y ago

Oh thx, so i have 3 models. relation look like incidents -> accounts -> contacts when create incident must have account and account must have contact

public class Incident
    {
        [Key]
        public string IncidentName { get; set; }

        [Required]
        [StringLength(100)]
        public string Description { get; set; }

        public virtual Account Account { get; set; }
    }

public class Incident
    {
        [Key]
        public string IncidentName { get; set; }

        [Required]
        [StringLength(100)]
        public string Description { get; set; }

        public virtual Account Account { get; set; }
    }

public class Account
    {
        [Key]
        public int Id { get; set; }
        [Required]
        public string Name { get; set; }
        [Required]
        public virtual Contact Contact { get; set; }
    }

public class Account
    {
        [Key]
        public int Id { get; set; }
        [Required]
        public string Name { get; set; }
        [Required]
        public virtual Contact Contact { get; set; }
    }

  public class Contact
    {
        [Key]
        public int Id { get; set; }
        [Required]
        public string FirstName { get; set; }
        [Required]
        public string LastName { get; set; }
        [Required]
        public string Email { get; set; }
    }

  public class Contact
    {
        [Key]
        public int Id { get; set; }
        [Required]
        public string FirstName { get; set; }
        [Required]
        public string LastName { get; set; }
        [Required]
        public string Email { get; set; }
    }

Models look like this And actually its look correctly in api

Elf•2y ago

Elf•2y ago

but i know it's not 😅

DeaDo•2y ago

looks alright to me

Elf•2y ago

Hmm, then I will ask a little differently

DeaDo•2y ago

what doesn't work?

Elf•2y ago

Models look like this When i try [GET] all incidents how can i show account in Response body

Elf•2y ago

Elf•2y ago

Here

DeaDo•2y ago

how does your query look?

Elf•2y ago

Now i have basic query

DeaDo•2y ago

have u included the account when accessing the incindent?

Elf•2y ago

I try another i have error

DeaDo•2y ago

yes this is the issue try .Include(i => i.Account)

Elf•2y ago

Yep, i try show by id In db its save like this. only id

Elf•2y ago

Elf•2y ago

Elf•2y ago

Elf•2y ago

All table save correctly with all infomation

DeaDo•2y ago

_context.Incident.Include(i => i.Account).ToListAsync(); this is as it should be

Elf•2y ago

O_o

DeaDo•2y ago

Elf•2y ago

i feel confused, it's worked 😅

DeaDo•2y ago

the include thing?

Elf•2y ago

DeaDo•2y ago

now u have to include the contact to the account _context.Incident.Include(i => i.Account).ThenInclude(a => a.Contact).ToListAsync(); u always have to use Include if u want to get data from a related table. EF will look for a entry that fits to the id u saved in the first table.

Elf•2y ago

I thought why it doesn't work forgot ThenInclude Thank you very, very much !♥️ But can i one more Question ?

DeaDo•2y ago

sure

Elf•2y ago

There is such a point in the test task, but I didn't quite understand it , from the point of view of logic database structure incidents -> accounts -> contacts incident -> account, 1=>M, account -> contact , 1=> M. Incident, incident name - primary key, autogenerated, string Account, Name - > unique string field Functionality create web api, asp core, ef code first (edited) Introduce the API to create the following records: contacts, accounts, incidents (edited) account cannot be created without contact incident cannot be created without account logic for incident creation method

**Request example
request body
{
account name,
contact first name,
contact last name,
contact email, // unique identifier,
incident description,
}**

**Request example
request body
{
account name,
contact first name,
contact last name,
contact email, // unique identifier,
incident description,
}**

Validation if account name is not in the system -> API must return 404 – NotFound if contact is in the system (check by email) -> update contact record, link contact to account if it has not been linked prevoisly. Otherwise, create new contact with first name, last name, email and link just created contact to the account create new incident, for account and populate incident description field I understand correctly its [POST] Request ?

DeaDo•2y ago

create = post

Elf•2y ago

Yep i know, i mean my post need look like this

Request example
request body
{
account name,
contact first name,
contact last name,
contact email, // unique identifier,
incident description,
}

Request example
request body
{
account name,
contact first name,
contact last name,
contact email, // unique identifier,
incident description,
}

Elf•2y ago

forget it i stupid 😅 I read it correctly again

DeaDo•2y ago

Personally i would create a new data-transfer-object in a case like that that object has all the properies the example shows In your post method u can create a new incident then and write all properties form the dto to the new incident and add it to DB if i understand it as wrong as u do 🙂

Elf•2y ago

Hmmm

DeaDo•2y ago

if the above should be the json content

Elf•2y ago

You mean to create a new model in which the required fields will be required, and when the post method is used, create incidents with fields from first model? Models only with this fields

request body
{
account name,
contact first name,
contact last name,
contact email, // unique identifier,
incident description,
}

request body
{
account name,
contact first name,
contact last name,
contact email, // unique identifier,
incident description,
}

DeaDo•2y ago

yes and a post method that takes this object and than creates a new Incident. Then u write all properties from that dto to the new incident

Elf•2y ago

Thank you very much ♥♥♥♥ If there are still problems, I will ask ♥

DeaDo•2y ago

👍 No problem

Unknown User•2y ago

Message Not Public

DeaDo•2y ago

I could solve my problem somehow. I refactored my code a bit and now i have a cleaner solution im satisified with. Im still interested in better solutions though. this was the original question btw. The 2nd question got here by mistake but it looked like a question i could answer so i tried to solve it in this post

Elf•2y ago

I stole this thread 😅 sr

DeaDo•2y ago

Gaming

Programming

ASP, Identity, Blazor Give Permission for delete to specific users.