From fb5536d29de5c8fa4c4594e072b3203ce0d4a26d Mon Sep 17 00:00:00 2001 From: Florian Edlmayer Date: Sun, 22 Feb 2026 12:37:28 +0100 Subject: [PATCH] Pdf Ansehen und PDF herunterladen gefixet --- .../ApplicationList.razor | 8 +- .../ServerEngineerApplicationService.cs | 93 +++++++++---------- 2 files changed, 48 insertions(+), 53 deletions(-) diff --git a/Client/Modules/SZUAbsolventenverein.Module.PremiumArea/ApplicationList.razor b/Client/Modules/SZUAbsolventenverein.Module.PremiumArea/ApplicationList.razor index e3d4015..8066fe5 100644 --- a/Client/Modules/SZUAbsolventenverein.Module.PremiumArea/ApplicationList.razor +++ b/Client/Modules/SZUAbsolventenverein.Module.PremiumArea/ApplicationList.razor @@ -41,7 +41,7 @@

- Herunterladen + Herunterladen
@@ -64,12 +64,12 @@ else
-
Antrags-PDF (@_selectedApp.FileId)
+
Antrags-PDF
-
- +
+
diff --git a/Server/Services/ServerEngineerApplicationService.cs b/Server/Services/ServerEngineerApplicationService.cs index 5786b96..1de724b 100644 --- a/Server/Services/ServerEngineerApplicationService.cs +++ b/Server/Services/ServerEngineerApplicationService.cs @@ -43,20 +43,28 @@ namespace SZUAbsolventenverein.Module.PremiumArea.Services return Task.FromResult(_repository.GetEngineerApplications(ModuleId).ToList()); } - // Check if Premium - if (IsUserPremium(user)) + var userId = _accessor.HttpContext.GetUserId(); + var results = new List(); + + // Always include the user's own applications (needed for Apply.razor) + if (userId != -1) { - // Return Approved AND Published - // Repository GetEngineerApplications(ModuleId, status) usually filters by status. - // If I want both, I might need 2 calls or update Repository. - // Simple approach: Get All and filter here? No, repository likely filters. - // Let's call twice and combine for now, or assume Repository supports "Published". - var approved = _repository.GetEngineerApplications(ModuleId, "Approved"); - var published = _repository.GetEngineerApplications(ModuleId, "Published"); - return Task.FromResult(approved.Union(published).ToList()); + var ownApps = _repository.GetEngineerApplications(ModuleId) + .Where(a => a.UserId == userId).ToList(); + results.AddRange(ownApps); } - return Task.FromResult(new List()); + // Check if Premium - also show approved/published apps from others + if (IsUserPremium(user)) + { + var approved = _repository.GetEngineerApplications(ModuleId, "Approved"); + var published = _repository.GetEngineerApplications(ModuleId, "Published"); + results.AddRange(approved.Union(published)); + // Remove duplicates (own apps might already be in approved/published) + results = results.GroupBy(a => a.ApplicationId).Select(g => g.First()).ToList(); + } + + return Task.FromResult(results); } public Task> GetApplicationsAsync(int ModuleId, string status) @@ -142,19 +150,23 @@ namespace SZUAbsolventenverein.Module.PremiumArea.Services var userId = _accessor.HttpContext.GetUserId(); bool isAdmin = _userPermissions.IsAuthorized(user, _alias.SiteId, EntityNames.Module, Application.ModuleId, PermissionNames.Edit); + bool isOwner = (userId != -1 && existing.UserId == userId); - if (isAdmin || (existing.UserId == userId && existing.Status == "Draft")) // Only owner can edit if Draft + if (isAdmin || isOwner) { if (!isAdmin) { - Application.Status = existing.Status == "Draft" && Application.Status == "Submitted" - ? "Published" - : existing.Status; // Auto-publish on submit - // If client sends "Published" (which Apply.razor does), apply it. - if (Application.Status == "Published" && existing.Status == "Draft") + // Owner can update their own application + // Accept "Published" status from client (auto-publish without admin approval) + if (Application.Status == "Published") { - Application.SubmittedOn = DateTime.UtcNow; - Application.ApprovedOn = DateTime.UtcNow; + Application.SubmittedOn ??= DateTime.UtcNow; + Application.ApprovedOn ??= DateTime.UtcNow; + } + else + { + // Keep existing status if client didn't explicitly set to Published + Application.Status = existing.Status; } } @@ -164,6 +176,9 @@ namespace SZUAbsolventenverein.Module.PremiumArea.Services return Task.FromResult(Application); } + _logger.Log(LogLevel.Error, this, LogFunction.Security, + "Unauthorized Update Attempt. UserId: {UserId}, AppOwner: {OwnerId}, IsAdmin: {IsAdmin}", + userId, existing.UserId, isAdmin); return Task.FromResult(null); } @@ -265,40 +280,20 @@ namespace SZUAbsolventenverein.Module.PremiumArea.Services private bool IsUserPremium(System.Security.Claims.ClaimsPrincipal user) { - // Oqtane's GetUserId() extension returns -1 if not found. - // We need to parse User object myself or use "User.Identity.Name" to find user if needed. - // But _premiumService.IsPremium(userId) asks for Int. - // I'll assume I can get UserId. - // Since Oqtane is weird with Claims sometimes, I'll use the Helper Extension `GetUserId()`. - // But wait, "GetUserId" is an extension on HttpContext or ClaimsPrincipal? - // In Oqtane.Shared.UserSecurity class? Or Oqtane.Extensions? - // Usually `_accessor.HttpContext.GlobalUserId()` ?? - // Let's rely on standard DI/Context. + if (!user.Identity.IsAuthenticated) + return false; - // NOTE: IsUserPremium check requires querying the DB via PremiumService. - // This could be expensive on every list call. Caching might be better but for now DB is fine. - - // To get UserId from ClaimsPrincipal: - // var userId = int.Parse(user.Claims.FirstOrDefault(c => c.Type == ClaimTypes.NameIdentifier).Value); - // I will use `_accessor.HttpContext.GetUserId()` from `Oqtane.Infrastructure` or similar if available. - // Since I am already using `_accessor`, I'll rely on Oqtane extensions being available. + // Check 1: Oqtane role "Premium Member" (matches the UI-level check in ApplicationList.razor) + if (user.IsInRole("Premium Member")) + return true; + // Check 2: Custom UserPremium DB table (for premium granted via GrantPremium/payment) int userId = -1; - // Trying standard Oqtane way which is usually: - if (user.Identity.IsAuthenticated) + var claim = user.Claims.FirstOrDefault(item => + item.Type == System.Security.Claims.ClaimTypes.NameIdentifier); + if (claim != null) { - // Using Oqtane.Shared.PrincipalExtensions? - // Let's just try to parse NameIdentifier if GetUserId() is not available in my context. - // But wait, `ModuleControllerBase` has `User` property. - // Here I am in a Service. - - // I will write a helper to safely get UserId. - var claim = user.Claims.FirstOrDefault(item => - item.Type == System.Security.Claims.ClaimTypes.NameIdentifier); - if (claim != null) - { - int.TryParse(claim.Value, out userId); - } + int.TryParse(claim.Value, out userId); } if (userId != -1)