From 2bd4a9b6e9dcf851ba8052e607d8c8da453a574e Mon Sep 17 00:00:00 2001
From: Sipke Schoorstra <sipkeschoorstra@outlook.com>
Date: Sat, 27 Aug 2022 22:16:48 +0200
Subject: [PATCH] Incremental work on secure endpoints

---
 .../Elsa.Api.Common/Abstractions/Endpoints.cs | 37 +++++++++++++++++++
 src/common/Elsa.Api.Common/PermissionNames.cs |  6 +++
 .../BulkDelete/Constants.cs                   | 12 ------
 .../BulkDelete/Endpoint.cs                    |  6 +--
 .../ActivityDefinitions/Delete/Constants.cs   | 12 ------
 .../ActivityDefinitions/Delete/Endpoint.cs    |  6 +--
 .../ActivityDefinitions/Get/Constants.cs      | 12 ------
 .../ActivityDefinitions/Get/Endpoint.cs       |  5 ++-
 .../ActivityDefinitions/List/Constants.cs     | 12 ------
 .../ActivityDefinitions/List/Endpoint.cs      |  5 ++-
 .../ActivityDefinitions/Post/Constants.cs     | 12 ------
 .../ActivityDefinitions/Post/Endpoint.cs      |  5 ++-
 .../ActivityDescriptors/List/Constants.cs     | 13 -------
 .../ActivityDescriptors/List/Endpoint.cs      | 14 ++-----
 14 files changed, 61 insertions(+), 96 deletions(-)
 create mode 100644 src/common/Elsa.Api.Common/Abstractions/Endpoints.cs
 create mode 100644 src/common/Elsa.Api.Common/PermissionNames.cs
 delete mode 100644 src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/BulkDelete/Constants.cs
 delete mode 100644 src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Delete/Constants.cs
 delete mode 100644 src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Constants.cs
 delete mode 100644 src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Constants.cs
 delete mode 100644 src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Constants.cs
 delete mode 100644 src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Constants.cs

diff --git a/src/common/Elsa.Api.Common/Abstractions/Endpoints.cs b/src/common/Elsa.Api.Common/Abstractions/Endpoints.cs
new file mode 100644
index 000000000..fb9c96231
--- /dev/null
+++ b/src/common/Elsa.Api.Common/Abstractions/Endpoints.cs
@@ -0,0 +1,37 @@
+using Elsa.Workflows.Core.Services;
+using FastEndpoints;
+
+namespace Elsa.Abstractions;
+
+public abstract class ElsaEndpointWithoutRequest<TResponse> : EndpointWithoutRequest<TResponse> where TResponse : notnull
+{
+    protected void ConfigurePermissions(params string[] permissions)
+    {
+        if (!EndpointSecurityOptions.SecurityIsEnabled)
+            AllowAnonymous();
+        else
+            Permissions((new[] { PermissionNames.All }).Concat(permissions).ToArray());
+    }
+}
+
+public class ElsaEndpoint<TRequest, TResponse> : Endpoint<TRequest, TResponse> where TRequest : notnull, new() where TResponse : notnull
+{
+    protected void ConfigurePermissions(params string[] permissions)
+    {
+        if (!EndpointSecurityOptions.SecurityIsEnabled)
+            AllowAnonymous();
+        else
+            Permissions((new[] { PermissionNames.All }).Concat(permissions).ToArray());
+    }
+}
+
+public class ElsaEndpoint<TRequest> : Endpoint<TRequest> where TRequest : notnull
+{
+    protected void ConfigurePermissions(params string[] permissions)
+    {
+        if (!EndpointSecurityOptions.SecurityIsEnabled)
+            AllowAnonymous();
+        else
+            Permissions((new[] { PermissionNames.All }).Concat(permissions).ToArray());
+    }
+}
\ No newline at end of file
diff --git a/src/common/Elsa.Api.Common/PermissionNames.cs b/src/common/Elsa.Api.Common/PermissionNames.cs
new file mode 100644
index 000000000..1664717cf
--- /dev/null
+++ b/src/common/Elsa.Api.Common/PermissionNames.cs
@@ -0,0 +1,6 @@
+namespace Elsa;
+
+public static class PermissionNames
+{
+    public const string All = "*";
+}
\ No newline at end of file
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/BulkDelete/Constants.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/BulkDelete/Constants.cs
deleted file mode 100644
index c0be13e24..000000000
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/BulkDelete/Constants.cs
+++ /dev/null
@@ -1,12 +0,0 @@
-namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.BulkDelete;
-
-/// <summary>
-/// Provides policy names accepted by the <see cref="BulkDelete"/> endpoint.
-/// </summary>
-public static class Constants
-{
-    /// <summary>
-    /// The policy name accepted by this endpoint.
-    /// </summary>
-    public const string PolicyName = "BulkDeleteActivityDefinitions";
-}
\ No newline at end of file
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/BulkDelete/Endpoint.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/BulkDelete/Endpoint.cs
index e19ea5423..f94984538 100644
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/BulkDelete/Endpoint.cs
+++ b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/BulkDelete/Endpoint.cs
@@ -1,12 +1,12 @@
+using Elsa.Abstractions;
 using Elsa.ActivityDefinitions.Services;
-using FastEndpoints;
 
 namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.BulkDelete;
 
 /// <summary>
 /// An endpoint that bulk-deletes activity definitions.
 /// </summary>
-public class BulkDelete : Endpoint<Request, Response>
+public class BulkDelete : ElsaEndpoint<Request, Response>
 {
     private readonly IActivityDefinitionStore _activityDefinitionStore;
 
@@ -20,7 +20,7 @@ public class BulkDelete : Endpoint<Request, Response>
     public override void Configure()
     {
         Post("/bulk-actions/delete/activity-definitions/by-definition-id");
-        Policies(Constants.PolicyName);
+        ConfigurePermissions("delete:activity-definitions");
     }
 
     /// <inheritdoc />
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Delete/Constants.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Delete/Constants.cs
deleted file mode 100644
index 1a0c8b651..000000000
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Delete/Constants.cs
+++ /dev/null
@@ -1,12 +0,0 @@
-namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.Delete;
-
-/// <summary>
-/// Provides policy names accepted by the <see cref="Delete"/> endpoint.
-/// </summary>
-public static class Constants
-{
-    /// <summary>
-    /// The policy name accepted by this endpoint.
-    /// </summary>
-    public const string PolicyName = "DeleteActivityDefinition";
-}
\ No newline at end of file
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Delete/Endpoint.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Delete/Endpoint.cs
index 1fef27ea9..f1d908b0d 100644
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Delete/Endpoint.cs
+++ b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Delete/Endpoint.cs
@@ -1,12 +1,12 @@
+using Elsa.Abstractions;
 using Elsa.ActivityDefinitions.Services;
-using FastEndpoints;
 
 namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.Delete;
 
 /// <summary>
 /// An endpoint that deletes a specific activity definition by ID.
 /// </summary>
-public class Delete : Endpoint<Request>
+public class Delete : ElsaEndpoint<Request>
 {
     private readonly IActivityDefinitionStore _activityDefinitionStore;
 
@@ -20,7 +20,7 @@ public class Delete : Endpoint<Request>
     public override void Configure()
     {
         Delete("/activity-definitions/{definitionId}");
-        Policies(Constants.PolicyName);
+        ConfigurePermissions("delete:activity-definitions");
     }
 
     /// <inheritdoc />
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Constants.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Constants.cs
deleted file mode 100644
index 85d6298a0..000000000
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Constants.cs
+++ /dev/null
@@ -1,12 +0,0 @@
-namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.Get;
-
-/// <summary>
-/// Provides policy names accepted by the <see cref="Get"/> endpoint.
-/// </summary>
-public static class Constants
-{
-    /// <summary>
-    /// The policy name accepted by this endpoint.
-    /// </summary>
-    public const string PolicyName = "ReadActivityDefinitions";
-}
\ No newline at end of file
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Endpoint.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Endpoint.cs
index ab5535d2f..77a4df9c1 100644
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Endpoint.cs
+++ b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Get/Endpoint.cs
@@ -1,5 +1,6 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Text.Json;
+using Elsa.Abstractions;
 using Elsa.ActivityDefinitions.Entities;
 using Elsa.ActivityDefinitions.Models;
 using Elsa.ActivityDefinitions.Services;
@@ -14,7 +15,7 @@ namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.Get;
 /// <summary>
 /// An endpoint that returns the specified <see cref="ActivityDefinition"/> by ID.
 /// </summary>
-public class Get : Endpoint<Request, ActivityDefinitionModel>
+public class Get : ElsaEndpoint<Request, ActivityDefinitionModel>
 {
     private readonly IActivityDefinitionStore _activityDefinitionStore;
     private readonly VariableDefinitionMapper _variableDefinitionMapper;
@@ -32,7 +33,7 @@ public class Get : Endpoint<Request, ActivityDefinitionModel>
     public override void Configure()
     {
         Get("/activity-definitions/{definitionId}");
-        Policies(Constants.PolicyName);
+        ConfigurePermissions("read:activity-definitions");
     }
 
     /// <inheritdoc />
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Constants.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Constants.cs
deleted file mode 100644
index d9dd55719..000000000
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Constants.cs
+++ /dev/null
@@ -1,12 +0,0 @@
-namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.List;
-
-/// <summary>
-/// Provides policy names accepted by the <see cref="List"/> endpoint.
-/// </summary>
-public static class Constants
-{
-    /// <summary>
-    /// The policy name accepted by this endpoint.
-    /// </summary>
-    public const string PolicyName = "ListActivityDefinitions";
-}
\ No newline at end of file
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Endpoint.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Endpoint.cs
index e8699bc80..3fcc41154 100644
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Endpoint.cs
+++ b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/List/Endpoint.cs
@@ -1,3 +1,4 @@
+using Elsa.Abstractions;
 using Elsa.ActivityDefinitions.Models;
 using Elsa.ActivityDefinitions.Services;
 using Elsa.Models;
@@ -8,7 +9,7 @@ namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.List;
 /// <summary>
 /// An endpoint that returns a page of <see cref="ActivityDefinitionSummary"/> objects. 
 /// </summary>
-public class List : Endpoint<Request, PagedListResponse<ActivityDefinitionSummary>>
+public class List : ElsaEndpoint<Request, PagedListResponse<ActivityDefinitionSummary>>
 {
     private readonly IActivityDefinitionStore _store;
 
@@ -22,7 +23,7 @@ public class List : Endpoint<Request, PagedListResponse<ActivityDefinitionSummar
     public override void Configure()
     {
         Get("/activity-definitions");
-        Policies(Constants.PolicyName);
+        ConfigurePermissions("read:activity-definitions");
     }
 
     /// <inheritdoc />
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Constants.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Constants.cs
deleted file mode 100644
index 11e202006..000000000
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Constants.cs
+++ /dev/null
@@ -1,12 +0,0 @@
-namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.Post;
-
-/// <summary>
-/// Provides policy names accepted by the <see cref="Post"/> endpoint.
-/// </summary>
-public static class Constants
-{
-    /// <summary>
-    /// The policy name accepted by this endpoint.
-    /// </summary>
-    public const string PolicyName = "CreateOrUpdateActivityDefinition";
-}
\ No newline at end of file
diff --git a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Endpoint.cs b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Endpoint.cs
index 3a62c6b3b..f41ea7b50 100644
--- a/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Endpoint.cs
+++ b/src/modules/Elsa.ActivityDefinitions/Endpoints/ActivityDefinitions/Post/Endpoint.cs
@@ -1,4 +1,5 @@
 using System.Text.Json;
+using Elsa.Abstractions;
 using Elsa.ActivityDefinitions.Entities;
 using Elsa.ActivityDefinitions.Services;
 using Elsa.Workflows.Core.Activities.Flowchart.Activities;
@@ -12,7 +13,7 @@ namespace Elsa.ActivityDefinitions.Endpoints.ActivityDefinitions.Post;
 /// <summary>
 /// An endpoint that creates or updates <see cref="ActivityDefinition"/> objects. 
 /// </summary>
-public class Post : Endpoint<Request, Response>
+public class Post : ElsaEndpoint<Request, Response>
 {
     private readonly SerializerOptionsProvider _serializerOptionsProvider;
     private readonly IActivityDefinitionPublisher _activityDefinitionPublisher;
@@ -33,7 +34,7 @@ public class Post : Endpoint<Request, Response>
     public override void Configure()
     {
         Post("/activity-definitions");
-        Policies(Constants.PolicyName);
+        ConfigurePermissions("write:activity-definitions");
     }
 
     /// <inheritdoc />
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Constants.cs b/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Constants.cs
deleted file mode 100644
index fb00fd5f5..000000000
--- a/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Constants.cs
+++ /dev/null
@@ -1,13 +0,0 @@
-
-namespace Elsa.Workflows.Api.Endpoints.ActivityDescriptors.List;
-
-/// <summary>
-/// Provides policy names accepted by the <see cref="List"/> endpoint.
-/// </summary>
-public static class Constants
-{
-    /// <summary>
-    /// The policy name accepted by this endpoint.
-    /// </summary>
-    public const string PolicyName = "ListActivityDescriptors";
-}
\ No newline at end of file
diff --git a/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Endpoint.cs b/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Endpoint.cs
index 17da7a353..7f6d8650b 100644
--- a/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Endpoint.cs
+++ b/src/modules/Elsa.Workflows.Api/Endpoints/ActivityDescriptors/List/Endpoint.cs
@@ -1,13 +1,14 @@
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using Elsa.Abstractions;
 using Elsa.Workflows.Core.Services;
 using Elsa.Workflows.Management.Services;
 using FastEndpoints;
 
 namespace Elsa.Workflows.Api.Endpoints.ActivityDescriptors.List;
 
-public class List : EndpointWithoutRequest<Response>
+public class List : ElsaEndpointWithoutRequest<Response>
 {
     private readonly IActivityRegistry _registry;
 
@@ -19,16 +20,7 @@ public class List : EndpointWithoutRequest<Response>
     public override void Configure()
     {
         Get("/descriptors/activities");
-        
-        if (!EndpointSecurityOptions.SecurityIsEnabled)
-        {
-            AllowAnonymous();
-        }
-        else
-        {
-            Roles("Admin", "Reader");    
-            Permissions("*", "list:activity-descriptors");
-        }
+        ConfigurePermissions("list:activity-descriptors");
     }
 
     public override Task<Response> ExecuteAsync(CancellationToken cancellationToken)