Class PermissionsController

Namespace

KadicAuth.Api.Controllers

Assembly

KadicAuth.Api.dll

[ApiController]
[Authorize]
[Route("api/[controller]")]
[Produces("application/json", new string[] { })]
public class PermissionsController : ControllerBase

Inheritance

object

ControllerBase

PermissionsController

Constructors

PermissionsController(IMediator, ILogger<PermissionsController>, IStringLocalizer<AuthMessages>)

public PermissionsController(IMediator mediator, ILogger<PermissionsController> logger, IStringLocalizer<AuthMessages> localizer)

Parameters

mediator IMediator

logger ILogger<PermissionsController>

localizer IStringLocalizer<AuthMessages>

Methods

ActivatePermission(Guid, CancellationToken)

Activate a permission

[HttpPost("{id:guid}/activate")]
[EnableRateLimiting("sensitive-write")]
[Authorize(Policy = "AUTH_PERMISSIONS_UPDATE")]
[ProducesResponseType(200)]
[ProducesResponseType(typeof(Error), 404)]
public Task<ActionResult> ActivatePermission(Guid id, CancellationToken cancellationToken)

Parameters

id Guid

cancellationToken CancellationToken

Returns

Task<ActionResult>

Remarks

Permission.Activate() existía en el dominio desde el principio y ningún handler lo llamaba. Este endpoint lo cablea.

CreatePermission(CreatePermissionDto, CancellationToken)

Create a new permission

[HttpPost]
[EnableRateLimiting("sensitive-write")]
[Authorize(Policy = "AUTH_PERMISSIONS_CREATE")]
[ProducesResponseType(typeof(Result<Guid>), 201)]
[ProducesResponseType(typeof(Result), 400)]
[ProducesResponseType(typeof(Result), 409)]
public Task<ActionResult> CreatePermission(CreatePermissionDto request, CancellationToken cancellationToken)

Parameters

request CreatePermissionDto

cancellationToken CancellationToken

Returns

Task<ActionResult>

DeactivatePermission(Guid, CancellationToken)

Deactivate a permission

[HttpPost("{id:guid}/deactivate")]
[EnableRateLimiting("sensitive-write")]
[Authorize(Policy = "AUTH_PERMISSIONS_UPDATE")]
[ProducesResponseType(200)]
[ProducesResponseType(typeof(Error), 404)]
[ProducesResponseType(typeof(Error), 409)]
public Task<ActionResult> DeactivatePermission(Guid id, CancellationToken cancellationToken)

Parameters

id Guid

cancellationToken CancellationToken

Returns

Task<ActionResult>

Remarks

Devuelve 409 si algún rol lo tiene concedido. Desactivar no es cosmético: la resolución efectiva filtra por Permission.IsActive, así que apagarlo revocaría el permiso al instante a todos esos roles.

DeletePermission(Guid, CancellationToken)

Delete a permission

[HttpDelete("{id:guid}")]
[EnableRateLimiting("sensitive-write")]
[Authorize(Policy = "AUTH_PERMISSIONS_DELETE")]
[ProducesResponseType(200)]
[ProducesResponseType(typeof(Error), 400)]
[ProducesResponseType(typeof(Error), 404)]
[ProducesResponseType(typeof(Error), 409)]
public Task<ActionResult> DeletePermission(Guid id, CancellationToken cancellationToken)

Parameters

id Guid

cancellationToken CancellationToken

Returns

Task<ActionResult>

Remarks

Devuelve 409 si algún rol tiene el permiso concedido. Antes se borraba directo: la FK hacia TenantRolesPermissions es NoAction, SQL Server rechazaba y —al no haber try/catch en el handler— el cliente recibía un 500. El borrado físico queda para permisos que nunca se concedieron; para el resto, desactivar.

GetPermissionByCode(string, CancellationToken)

Get a permission by its code

[HttpGet("by-code/{code}")]
[Authorize(Policy = "AUTH_PERMISSIONS_VIEW")]
[ProducesResponseType(typeof(PermissionDto), 200)]
[ProducesResponseType(typeof(Error), 404)]
[ProducesResponseType(typeof(Error), 400)]
public Task<ActionResult<PermissionDto>> GetPermissionByCode(string code, CancellationToken cancellationToken)

Parameters

code string

cancellationToken CancellationToken

Returns

Task<ActionResult<PermissionDto>>

GetPermissionById(string, CancellationToken)

Get permission by ID

[HttpGet("{id}")]
[Authorize(Policy = "AUTH_PERMISSIONS_VIEW")]
[ProducesResponseType(typeof(PermissionDto), 200)]
[ProducesResponseType(typeof(Error), 404)]
[ProducesResponseType(typeof(Error), 400)]
public Task<ActionResult<PermissionDto>> GetPermissionById(string id, CancellationToken cancellationToken)

Parameters

id string

cancellationToken CancellationToken

Returns

Task<ActionResult<PermissionDto>>

GetPermissionDependencies(Guid, CancellationToken)

Qué roles tienen concedido este permiso, y por tanto qué se rompería al desactivarlo o borrarlo.

[HttpGet("{id:guid}/dependencies")]
[Authorize(Policy = "AUTH_PERMISSIONS_VIEW")]
[ProducesResponseType(typeof(PermissionDependencies), 200)]
public Task<ActionResult<PermissionDependencies>> GetPermissionDependencies(Guid id, CancellationToken cancellationToken)

Parameters

id Guid

cancellationToken CancellationToken

Returns

Task<ActionResult<PermissionDependencies>>

GetPermissionDiff(CancellationToken)

Returns the diff between permissions defined in code and those currently in the database: which are missing (ToInsert), which have a changed name (ToUpdate), and which exist in DB but are no longer declared in code (Orphaned).

[HttpGet("diff")]
[Authorize(Policy = "AUTH_PERMISSIONS_VIEW")]
public Task<IActionResult> GetPermissionDiff(CancellationToken cancellationToken)

Parameters

cancellationToken CancellationToken

Returns

Task<IActionResult>

GetPermissions(PaginatorRequestDto, CancellationToken)

Get all permissions paginated

[HttpGet]
[Authorize(Policy = "AUTH_PERMISSIONS_VIEW")]
[ProducesResponseType(typeof(PaginatorResponseDto<PermissionDto>), 200)]
[ProducesResponseType(typeof(Error), 400)]
public Task<ActionResult<PaginatorResponseDto<PermissionDto>>> GetPermissions(PaginatorRequestDto paginatorRequest, CancellationToken cancellationToken)

Parameters

paginatorRequest PaginatorRequestDto

cancellationToken CancellationToken

Returns

Task<ActionResult<PaginatorResponseDto<PermissionDto>>>

GetRolesByPermissionSlug(string, CancellationToken)

Get all roles that have a specific permission assigned, looked up by permission code (slug)

[HttpGet("by-slug/{slug}/roles")]
[Authorize(Policy = "AUTH_PERMISSIONS_VIEW")]
[ProducesResponseType(typeof(List<RoleDto>), 200)]
[ProducesResponseType(typeof(Error), 400)]
public Task<ActionResult<List<RoleDto>>> GetRolesByPermissionSlug(string slug, CancellationToken cancellationToken)

Parameters

slug string

cancellationToken CancellationToken

Returns

Task<ActionResult<List<RoleDto>>>

SeedPermissions(SeedPermissionsCommand, CancellationToken)

Seed permissions in bulk: creates submodules if needed, inserts permissions that don't exist, and assigns all new permissions to every active Role and TenantRole. Idempotent — already-existing permissions are skipped.

[HttpPost("seed")]
[EnableRateLimiting("sensitive-write")]
[Authorize(Policy = "AUTH_PERMISSIONS_CREATE")]
[ProducesResponseType(typeof(Result<SeedPermissionsResult>), 200)]
[ProducesResponseType(typeof(Result), 400)]
[ProducesResponseType(typeof(Result), 422)]
public Task<ActionResult> SeedPermissions(SeedPermissionsCommand command, CancellationToken cancellationToken)

Parameters

command SeedPermissionsCommand

cancellationToken CancellationToken

Returns

Task<ActionResult>

UpdatePermission(Guid, UpdatePermissionDto, CancellationToken)

Update an existing permission

[HttpPut("{id:guid}")]
[EnableRateLimiting("sensitive-write")]
[Authorize(Policy = "AUTH_PERMISSIONS_UPDATE")]
[ProducesResponseType(typeof(Result), 200)]
[ProducesResponseType(typeof(Result), 404)]
[ProducesResponseType(typeof(Result), 400)]
public Task<ActionResult> UpdatePermission(Guid id, UpdatePermissionDto request, CancellationToken cancellationToken)

Parameters

id Guid

request UpdatePermissionDto

cancellationToken CancellationToken

Returns

Task<ActionResult>