| | | 1 | | namespace Chronicis.Client.Services; |
| | | 2 | | |
| | | 3 | | /// <summary> |
| | | 4 | | /// System admin authorization service. |
| | | 5 | | /// TODO: Replace hardcoded user check with role-based claims from Auth0. |
| | | 6 | | /// </summary> |
| | | 7 | | public class AdminAuthService : IAdminAuthService |
| | | 8 | | { |
| | | 9 | | private readonly IAuthService _authService; |
| | | 10 | | private readonly ILogger<AdminAuthService> _logger; |
| | | 11 | | |
| | | 12 | | // Hardcoded sysadmin identifiers — extend to role-based in the future |
| | 0 | 13 | | private static readonly HashSet<string> SysAdminEmails = new(StringComparer.OrdinalIgnoreCase) |
| | 0 | 14 | | { |
| | 0 | 15 | | "dave@chronicis.app" |
| | 0 | 16 | | }; |
| | | 17 | | |
| | 0 | 18 | | private static readonly HashSet<string> SysAdminAuth0Ids = new(StringComparer.OrdinalIgnoreCase) |
| | 0 | 19 | | { |
| | 0 | 20 | | "oauth2|discord|992501439685460139" |
| | 0 | 21 | | }; |
| | | 22 | | |
| | 0 | 23 | | public AdminAuthService(IAuthService authService, ILogger<AdminAuthService> logger) |
| | | 24 | | { |
| | 0 | 25 | | _authService = authService; |
| | 0 | 26 | | _logger = logger; |
| | 0 | 27 | | } |
| | | 28 | | |
| | | 29 | | public async Task<bool> IsSysAdminAsync() |
| | | 30 | | { |
| | 0 | 31 | | var user = await _authService.GetCurrentUserAsync(); |
| | 0 | 32 | | if (user == null) |
| | 0 | 33 | | return false; |
| | | 34 | | |
| | 0 | 35 | | return SysAdminEmails.Contains(user.Email) |
| | 0 | 36 | | || SysAdminAuth0Ids.Contains(user.Auth0UserId); |
| | 0 | 37 | | } |
| | | 38 | | } |