mirrors/btcpayserver
1
0
Fork 0
mirror of https://github.com/btcpayserver/btcpayserver.git synced 2025-02-22 14:22:40 +01:00
Code Issues Projects Releases Packages Wiki Activity

Use policies security for controlling access to bitpay api

Browse source
This commit is contained in:
nicolas.dorier 2018-05-11 17:16:18 +09:00
parent 199db01eaf
commit 6f07849e1d
2 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
BTCPayServer/Controllers/InvoiceController.API.cs
View file

@ -13,11 +13,14 @@ using BTCPayServer.Data;
using BTCPayServer.Services.Invoices; using BTCPayServer.Services.Invoices;
using Microsoft.AspNetCore.Cors; using Microsoft.AspNetCore.Cors;
using BTCPayServer.Services.Stores; using BTCPayServer.Services.Stores;
using Microsoft.AspNetCore.Authorization;
using BTCPayServer.Security;
namespace BTCPayServer.Controllers namespace BTCPayServer.Controllers
{ {
[EnableCors("BitpayAPI")] [EnableCors("BitpayAPI")]
[BitpayAPIConstraint] [BitpayAPIConstraint]
[Authorize(Policies.CanUseStore.Key)]
public class InvoiceControllerAPI : Controller public class InvoiceControllerAPI : Controller
{ {
private InvoiceController _InvoiceController; private InvoiceController _InvoiceController;
@ -43,6 +46,7 @@ namespace BTCPayServer.Controllers
[HttpGet] [HttpGet]
[Route("invoices/{id}")] [Route("invoices/{id}")]
[AllowAnonymous]
public async Task<DataWrapper<InvoiceResponse>> GetInvoice(string id, string token) public async Task<DataWrapper<InvoiceResponse>> GetInvoice(string id, string token)
{ {
var invoice = await _InvoiceRepository.GetInvoice(null, id); var invoice = await _InvoiceRepository.GetInvoice(null, id);

4
BTCPayServer/Security/BitpayClaimsFilter.cs
View file

@ -79,13 +79,13 @@ namespace BTCPayServer.Security
if (storeId != null) if (storeId != null)
{ {
var identity = ((ClaimsIdentity)context.HttpContext.User.Identity); var identity = ((ClaimsIdentity)context.HttpContext.User.Identity);
identity.AddClaim(new Claim(Claims.OwnStore, storeId)); identity.AddClaim(new Claim(Policies.CanUseStore.Key, storeId));
var store = await _StoreRepository.FindStore(storeId); var store = await _StoreRepository.FindStore(storeId);
context.HttpContext.SetStoreData(store); context.HttpContext.SetStoreData(store);
} }
else if (failedAuth) else if (failedAuth)
{ {
throw new BitpayHttpException(401, "Can't access to store"); throw new BitpayHttpException(401, "Invalid credentials");
} }
} }
} }