Merge pull request #5 from awork-io/codex/workspace-access-control

[Feature] Add workspace access control settings

Author: nilzzzzzz

backend/Auth/AuthCallbackResult.cs

@@ -0,0 +1,11 @@
+using Backend.Data.Entities;
+
+namespace Backend.Auth;
+
+public class AuthCallbackResult
+{
+    public bool Success { get; set; }
+    public string? Error { get; set; }
+    public string? SessionToken { get; set; }
+    public User? User { get; set; }
+}

backend/Auth/AuthInitResult.cs

@@ -0,0 +1,7 @@
+namespace Backend.Auth;
+
+public class AuthInitResult
+{
+    public required string AuthorizationUrl { get; set; }
+    public required string State { get; set; }
+}

backend/Auth/AuthMiddleware.cs

@@ -62,7 +62,8 @@ public static RouteHandlerBuilder RequireAuth(this RouteHandlerBuilder builder)
     {
         return builder.AddEndpointFilter(async (context, next) =>
         {
-            var user = context.HttpContext.User;
+            var httpContext = context.HttpContext;
+            var user = httpContext.User;
             var userId = JwtService.GetUserId(user);
             var workspaceId = JwtService.GetWorkspaceId(user);
 
@@ -71,6 +72,23 @@ public static RouteHandlerBuilder RequireAuth(this RouteHandlerBuilder builder)
                 return Results.Unauthorized();
             }
 
+            var path = httpContext.Request.Path.Value ?? string.Empty;
+            var isAuthStatusRoute =
+                string.Equals(path, "/api/auth/me", StringComparison.OrdinalIgnoreCase) ||
+                string.Equals(path, "/api/auth/logout", StringComparison.OrdinalIgnoreCase);
+
+            if (!isAuthStatusRoute)
+            {
+                var workspaceAccessService = httpContext.RequestServices.GetRequiredService<Backend.WorkspaceAccess.WorkspaceAccessService>();
+                var hasFormsAccess = await workspaceAccessService.HasFormsAccess(userId.Value);
+                if (!hasFormsAccess)
+                {
+                    return Results.Json(
+                        new { error = "Forms access denied.", code = "FORMS_ACCESS_DENIED" },
+                        statusCode: StatusCodes.Status403Forbidden);
+                }
+            }
+
             return await next(context);
         });
     }

backend/Auth/AuthService.cs

@@ -17,9 +17,12 @@ public class AuthService
     private readonly string _aworkAuthUrl;
     private readonly string _aworkTokenUrl;
     private readonly string _aworkUserInfoUrl;
+    private readonly string _aworkPermissionsUrl;
     private readonly string _aworkDcrUrl;
 
     private const string DefaultAworkApiBaseUrl = "https://api.awork.com/api/v1";
+    private const string WorkspaceManageConfigFeature = "workspace-manage-config";
+    private static readonly string[] WorkspaceManageConfigAccessLevels = ["manage", "write", "config"];
 
     private const string DcrClientName = "awork Forms";
     private const string DcrScope = "offline_access full_access";
@@ -48,6 +51,7 @@ public AuthService(
         _aworkAuthUrl = $"{baseUrl}/accounts/authorize";
         _aworkTokenUrl = $"{baseUrl}/accounts/token";
         _aworkUserInfoUrl = $"{baseUrl}/me";
+        _aworkPermissionsUrl = $"{baseUrl}/me/permissions";
         _aworkDcrUrl = $"{baseUrl}/clientapplications/register";
     }
 
@@ -77,6 +81,9 @@ public static string GenerateState()
         return Base64UrlEncode(bytes);
     }
 
+    /// <summary>
+    /// Starts the awork OAuth flow and persists the PKCE state.
+    /// </summary>
     public async Task<AuthInitResult> InitiateAuth()
     {
         var clientId = await GetOrCreateDcrClientId();
@@ -103,6 +110,9 @@ public async Task<AuthInitResult> InitiateAuth()
         return new AuthInitResult { AuthorizationUrl = authUrl, State = state };
     }
 
+    /// <summary>
+    /// Completes the OAuth callback, upserts the user, and issues the Forms session token.
+    /// </summary>
     public async Task<AuthCallbackResult> HandleCallback(string code, string state)
     {
         OAuthState? pkceState;
@@ -133,24 +143,15 @@ public async Task<AuthCallbackResult> HandleCallback(string code, string state)
             if (userInfo == null)
                 return new AuthCallbackResult { Success = false, Error = "Failed to get user info" };
 
-            var user = await UpsertUser(userInfo, tokenResult);
+            var permissionSnapshot = await GetWorkspaceAccessPermissionSnapshot(tokenResult.AccessToken!);
+            var user = await UpsertUser(userInfo, tokenResult, permissionSnapshot);
             var sessionToken = _jwtService.GenerateToken(user.Id, user.AworkUserId, user.AworkWorkspaceId);
 
             return new AuthCallbackResult
             {
                 Success = true,
                 SessionToken = sessionToken,
-                User = new UserDto
-                {
-                    Id = user.Id,
-                    Email = user.Email,
-                    Name = user.Name,
-                    AvatarUrl = user.AvatarUrl,
-                    WorkspaceId = user.AworkWorkspaceId,
-                    WorkspaceName = user.WorkspaceName,
-                    WorkspaceUrl = user.WorkspaceUrl,
-                    HasRefreshToken = !string.IsNullOrEmpty(user.RefreshToken)
-                }
+                User = user
             };
         }
         catch (Exception ex)
@@ -160,6 +161,9 @@ public async Task<AuthCallbackResult> HandleCallback(string code, string state)
         }
     }
 
+    /// <summary>
+    /// Clears the stored awork tokens for the given user.
+    /// </summary>
     public async Task ClearUserTokens(Guid userId)
     {
         await using var db = await _dbFactory.CreateDbContextAsync();
@@ -296,7 +300,33 @@ private async Task<TokenResult> ExchangeCodeForTokens(string code, string codeVe
         return userInfo;
     }
 
-    private async Task<User> UpsertUser(AworkUserInfo userInfo, TokenResult tokenResult)
+    private async Task<WorkspaceAccessPermissionSnapshot> GetWorkspaceAccessPermissionSnapshot(string accessToken)
+    {
+        var request = new HttpRequestMessage(HttpMethod.Get, _aworkPermissionsUrl);
+        request.Headers.Add("Authorization", $"Bearer {accessToken}");
+
+        var response = await _httpClient.SendAsync(request);
+        if (!response.IsSuccessStatusCode) return new WorkspaceAccessPermissionSnapshot();
+
+        var json = await response.Content.ReadAsStringAsync();
+        var permissions = JsonSerializer.Deserialize<AworkPermissionInfoResponse>(json, new JsonSerializerOptions
+        {
+            PropertyNameCaseInsensitive = true
+        });
+
+        var canManageWorkspaceAccess = permissions?.UserPermission?.Permissions?.Any(permission =>
+            string.Equals(permission.Feature, WorkspaceManageConfigFeature, StringComparison.OrdinalIgnoreCase) &&
+            permission.AccessLevels?.Any(level =>
+                WorkspaceManageConfigAccessLevels.Contains(level, StringComparer.OrdinalIgnoreCase)) == true) == true;
+
+        return new WorkspaceAccessPermissionSnapshot
+        {
+            IsAdmin = permissions?.UserPermission?.IsAdmin == true,
+            CanManageWorkspaceAccess = canManageWorkspaceAccess
+        };
+    }
+
+    private async Task<User> UpsertUser(AworkUserInfo userInfo, TokenResult tokenResult, WorkspaceAccessPermissionSnapshot permissionSnapshot)
     {
         await using var db = await _dbFactory.CreateDbContextAsync();
 
@@ -315,6 +345,8 @@ private async Task<User> UpsertUser(AworkUserInfo userInfo, TokenResult tokenRes
             {
                 AworkUserId = userInfo.Id,
                 AworkWorkspaceId = workspaceId,
+                IsAworkAdmin = permissionSnapshot.IsAdmin,
+                CanManageWorkspaceAccess = permissionSnapshot.CanManageWorkspaceAccess,
                 WorkspaceName = userInfo.Workspace?.Name,
                 WorkspaceUrl = userInfo.Workspace?.Url,
                 Email = userInfo.Email ?? "",
@@ -335,6 +367,8 @@ private async Task<User> UpsertUser(AworkUserInfo userInfo, TokenResult tokenRes
             user.Email = userInfo.Email ?? user.Email;
             user.Name = $"{userInfo.FirstName} {userInfo.LastName}".Trim();
             user.AvatarUrl = userInfo.ProfileImage;
+            user.IsAworkAdmin = permissionSnapshot.IsAdmin;
+            user.CanManageWorkspaceAccess = permissionSnapshot.CanManageWorkspaceAccess;
             if (!string.IsNullOrWhiteSpace(userInfo.Workspace?.Name))
                 user.WorkspaceName = userInfo.Workspace.Name;
             if (!string.IsNullOrWhiteSpace(userInfo.Workspace?.Url))
@@ -349,12 +383,49 @@ private async Task<User> UpsertUser(AworkUserInfo userInfo, TokenResult tokenRes
         return user;
     }
 
+    /// <summary>
+    /// Returns the stored local user by Forms user id.
+    /// </summary>
     public async Task<User?> GetUserById(Guid userId)
     {
         await using var db = await _dbFactory.CreateDbContextAsync();
         return await db.Users.FindAsync(userId);
     }
 
+    /// <summary>
+    /// Refreshes the stored admin and manage-config flags from awork.
+    /// </summary>
+    public async Task RefreshWorkspaceAccessPermission(Guid userId)
+    {
+        try
+        {
+            var accessToken = await GetValidAccessToken(userId);
+            if (string.IsNullOrEmpty(accessToken))
+                return;
+
+            var permissionSnapshot = await GetWorkspaceAccessPermissionSnapshot(accessToken);
+
+            await using var db = await _dbFactory.CreateDbContextAsync();
+            var user = await db.Users.FindAsync(userId);
+            if (user == null ||
+                (user.CanManageWorkspaceAccess == permissionSnapshot.CanManageWorkspaceAccess &&
+                 user.IsAworkAdmin == permissionSnapshot.IsAdmin))
+                return;
+
+            user.IsAworkAdmin = permissionSnapshot.IsAdmin;
+            user.CanManageWorkspaceAccess = permissionSnapshot.CanManageWorkspaceAccess;
+            user.UpdatedAt = DateTime.UtcNow;
+            await db.SaveChangesAsync();
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"Failed to refresh workspace access permissions for user {userId}: {ex.Message}");
+        }
+    }
+
+    /// <summary>
+    /// Returns a usable awork access token, refreshing it when needed.
+    /// </summary>
     public async Task<string?> GetValidAccessToken(Guid userId, bool forceRefresh = false)
     {
         await using var db = await _dbFactory.CreateDbContextAsync();

backend/Auth/AuthTokenResponse.cs

@@ -0,0 +1,18 @@
+using System.Text.Json.Serialization;
+
+namespace Backend.Auth;
+
+public class AuthTokenResponse
+{
+    [JsonPropertyName("access_token")]
+    public string AccessToken { get; set; } = string.Empty;
+
+    [JsonPropertyName("refresh_token")]
+    public string? RefreshToken { get; set; }
+
+    [JsonPropertyName("expires_in")]
+    public int ExpiresIn { get; set; }
+
+    [JsonPropertyName("token_type")]
+    public string TokenType { get; set; } = string.Empty;
+}

backend/Auth/AworkPermission.cs

@@ -0,0 +1,7 @@
+namespace Backend.Auth;
+
+public class AworkPermission
+{
+    public string? Feature { get; set; }
+    public List<string>? AccessLevels { get; set; }
+}

backend/Auth/AworkPermissionInfoResponse.cs

@@ -0,0 +1,6 @@
+namespace Backend.Auth;
+
+public class AworkPermissionInfoResponse
+{
+    public AworkUserPermission? UserPermission { get; set; }
+}

backend/Auth/AworkUserInfo.cs

@@ -0,0 +1,13 @@
+namespace Backend.Auth;
+
+public class AworkUserInfo
+{
+    public Guid Id { get; set; }
+    public string? Email { get; set; }
+    public string? FirstName { get; set; }
+    public string? LastName { get; set; }
+    public string? ProfileImage { get; set; }
+    public Guid? WorkspaceId { get; set; }
+    public Guid? AccountId { get; set; }
+    public AworkWorkspaceInfo? Workspace { get; set; }
+}

backend/Auth/AworkUserPermission.cs

@@ -0,0 +1,7 @@
+namespace Backend.Auth;
+
+public class AworkUserPermission
+{
+    public bool IsAdmin { get; set; }
+    public List<AworkPermission>? Permissions { get; set; }
+}

backend/Auth/AworkWorkspaceInfo.cs

@@ -0,0 +1,8 @@
+namespace Backend.Auth;
+
+public class AworkWorkspaceInfo
+{
+    public Guid Id { get; set; }
+    public string? Name { get; set; }
+    public string? Url { get; set; }
+}