Changeset b373fea for ChapterX.API/Controllers/UsersController.cs

Timestamp:

06/23/26 15:20:39 (12 days ago)

Author:

kikisrbinoska <srbinoskakristina07@…>

Branches:

main

Children:

0b502c2

Parents:

d300631

Message:

Fixes for authentication and auhtorization\

File:

• ChapterX.API/Controllers/UsersController.cs (modified) (3 diffs)

ChapterX.API/Controllers/UsersController.cs

@@ -5 +5 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
 
 namespace ChapterX.API.Controllers
@@ -67 +69 @@
             }
 
+            var callerId = int.Parse(User.FindFirstValue(JwtRegisteredClaimNames.Sub)!);
+            var isAdmin = User.IsInRole("Admin");
+            if (callerId != id && !isAdmin)
+                return Forbid();
+
             var response = await _mediator.Send(request);
             return Ok(response);
@@ -76 +83 @@
         {
             _logger.LogInformation("Deleting user with ID: {UserId}", id);
+            var callerId = int.Parse(User.FindFirstValue(JwtRegisteredClaimNames.Sub)!);
+            var isAdmin = User.IsInRole("Admin");
+            if (callerId != id && !isAdmin)
+                return Forbid();
+
             var response = await _mediator.Send(new DeleteRequest(id));
             return Ok(response);