SharpRSS/SharpRSS.API/Auth/SessionAuthorizeAttribute.cs

using System;
using System.Linq;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Filters;
using ToolQit;
using ToolQit.Logging;

namespace SharpRSS.API.Auth
{
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]
    public class SessionAuthorizeAttribute : Attribute, IAuthorizationFilter
    {
        public SessionAuthorizeAttribute(string permission = "")
        {
            _log = LogManager.CreateLogger(typeof(SessionAuthorizeAttribute));
            _perm = permission;
        }

        private readonly ILog _log;
        private readonly string _perm;

        public void OnAuthorization(AuthorizationFilterContext context)
        {
            if (context.ActionDescriptor.EndpointMetadata.Any(obj => obj.GetType() == typeof(AllowAnonymousAttribute)))
            {
                context.Result = new OkResult();
                return;
            }
            //TODO: Check session ID!
            context.Result = new UnauthorizedResult();
        }
    }
}