CP.Resumes/Program.cs at master · clearplan/CP.Resumes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc.Authorization;
using Microsoft.Identity.Web;
using Microsoft.Identity.Web.UI;
using CP.Resumes.Helpers;
using Microsoft.EntityFrameworkCore;
using CP.Resumes.Data;

var builder = WebApplication.CreateBuilder(args);

var initialScopes = builder.Configuration["DownstreamApi:Scopes"]?.Split(' ') ?? builder.Configuration["MicrosoftGraph:Scopes"]?.Split(' ');

// Add services to the container.
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
        .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
            .AddMicrosoftGraph(builder.Configuration.GetSection("MicrosoftGraph"))
            .AddInMemoryTokenCaches();

builder.Services.AddAuthorization(options =>
{
    options.FallbackPolicy = options.DefaultPolicy;
    options.AddPolicy("administrators", p => { p.RequireClaim("groups", SecurityGroup.AppAdministrators); });
    options.AddPolicy("recruiting", p => { p.RequireClaim("groups", SecurityGroup.AppRecruiting); });
    options.AddPolicy("hr", p => { p.RequireClaim("groups", SecurityGroup.AppHumanResources); });
    options.AddPolicy("managers", p => { p.RequireClaim("groups", SecurityGroup.AppManagers); });

    options.AddPolicy("hr", b => b.RequireAssertion(c =>
        c.User.HasClaim("groups", SecurityGroup.AppHumanResources)
    ));

    options.AddPolicy("recruiting", b => b.RequireAssertion(c =>
        c.User.HasClaim("groups", SecurityGroup.AppRecruiting)
    ));

    options.AddPolicy("managers", b => b.RequireAssertion(c =>
        c.User.HasClaim("groups", SecurityGroup.AppManagers)
    ));

    options.AddPolicy("hr,recruiting", b => b.RequireAssertion(c =>
        c.User.HasClaim("groups", SecurityGroup.AppHumanResources) ||
        c.User.HasClaim("groups", SecurityGroup.AppRecruiting)
    ));

    options.AddPolicy("hr,managers", b => b.RequireAssertion(c =>
        c.User.HasClaim("groups", SecurityGroup.AppHumanResources) ||
        c.User.HasClaim("groups", SecurityGroup.AppManagers)
    ));

    options.AddPolicy("recruiting,managers", b => b.RequireAssertion(c =>
        c.User.HasClaim("groups", SecurityGroup.AppRecruiting) ||
        c.User.HasClaim("groups", SecurityGroup.AppManagers)
    ));

    options.AddPolicy("hr,recruiting,managers", b => b.RequireAssertion(c =>
        c.User.HasClaim("groups", SecurityGroup.AppHumanResources) ||
        c.User.HasClaim("groups", SecurityGroup.AppRecruiting) ||
        c.User.HasClaim("groups", SecurityGroup.AppManagers)
    ));

    options.AddPolicy("administrators,hr,recruiting", b => b.RequireAssertion(c =>
        c.User.HasClaim("groups", SecurityGroup.AppAdministrators) ||
        c.User.HasClaim("groups", SecurityGroup.AppHumanResources) ||
        c.User.HasClaim("groups", SecurityGroup.AppRecruiting)
    ));

    options.AddPolicy("administrators,recruiting,managers", b => b.RequireAssertion(c =>
        c.User.HasClaim("groups", SecurityGroup.AppAdministrators) ||
        c.User.HasClaim("groups", SecurityGroup.AppManagers) ||
        c.User.HasClaim("groups", SecurityGroup.AppRecruiting)
    ));

    options.AddPolicy("super", b => b.RequireAssertion(c =>
        c.User.HasClaim("groups", SecurityGroup.AppAdministrators) ||
        c.User.HasClaim("groups", SecurityGroup.AppHumanResources) ||
        c.User.HasClaim("groups", SecurityGroup.AppManagers) ||
        c.User.HasClaim("groups", SecurityGroup.AppRecruiting)
    ));
});

//builder.Services.AddDbContext<ResumeContext>(options => options.UseSqlServer(builder.Configuration.GetConnectionString("ResumeContext")));

builder.Services.Configure<RouteOptions>(options =>
{
    options.LowercaseQueryStrings = true;
    options.LowercaseUrls = true;
});

builder.Services.AddControllersWithViews(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
    options.Filters.Add(new AuthorizeFilter(policy));
});

builder.Services.AddRazorPages().AddMicrosoftIdentityUI();

//builder.Services.AddWebOptimizer(options =>
//{

//});

var app = builder.Build();

// Configure the HTTP request pipeline.
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Home/Error");
    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();

app.UseAuthentication();

app.UseAuthorization();

app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");
app.MapRazorPages();
app.MapControllers();

app.Run();