Read Only Account Changes + Fixes from last PR

API/Controllers/AccountController.cs

@@ -457,6 +457,7 @@ public async Task<ActionResult> UpdateAgeRestriction(UpdateAgeRestrictionDto dto
     {
         var user = await _unitOfWork.UserRepository.GetUserByUsernameAsync(User.GetUsername());
         if (user == null) return Unauthorized(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
 
         var isAdmin = await _unitOfWork.UserRepository.IsUserAdminAsync(user);
         if (!await _accountService.CanChangeAgeRestriction(user)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
@@ -494,6 +495,7 @@ public async Task<ActionResult> UpdateAccount(UpdateUserDto dto)
         var adminUser = await _unitOfWork.UserRepository.GetUserByUsernameAsync(User.GetUsername());
         if (adminUser == null) return Unauthorized();
         if (!await _unitOfWork.UserRepository.IsUserAdminAsync(adminUser)) return Unauthorized(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
 
         var user = await _unitOfWork.UserRepository.GetUserByIdAsync(dto.UserId, AppUserIncludes.SideNavStreams);
         if (user == null) return BadRequest(await _localizationService.Translate(User.GetUserId(), "no-user"));
@@ -911,7 +913,6 @@ public async Task<ActionResult<string>> ConfirmForgotPassword(ConfirmPasswordRes
     [EnableRateLimiting("Authentication")]
     public async Task<ActionResult<string>> ForgotPassword([FromQuery] string email)
     {
-
         var settings = await _unitOfWork.SettingsRepository.GetSettingsDtoAsync();
         var user = await _unitOfWork.UserRepository.GetUserByEmailAsync(email);
         if (user == null)
@@ -1012,6 +1013,8 @@ public async Task<ActionResult<InviteUserResponse>> ResendConfirmationSendEmail(
                 await _localizationService.Translate(user.Id, "user-migration-needed"));
         if (user.EmailConfirmed) return BadRequest(await _localizationService.Translate(user.Id, "user-already-confirmed"));
 
+        // TODO: If the target user is read only, we might want to just forgo this
+
         var token = await _userManager.GenerateEmailConfirmationTokenAsync(user);
         user.ConfirmationToken = token;
         _unitOfWork.UserRepository.Update(user);

API/Controllers/CBLController.cs

@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Threading.Tasks;
+using API.Constants;
 using API.DTOs.ReadingLists.CBL;
 using API.Extensions;
 using API.Services;
@@ -20,11 +21,13 @@ public class CblController : BaseApiController
 {
     private readonly IReadingListService _readingListService;
     private readonly IDirectoryService _directoryService;
+    private readonly ILocalizationService _localizationService;
 
-    public CblController(IReadingListService readingListService, IDirectoryService directoryService)
+    public CblController(IReadingListService readingListService, IDirectoryService directoryService, ILocalizationService localizationService)
     {
         _readingListService = readingListService;
         _directoryService = directoryService;
+        _localizationService = localizationService;
     }
 
     /// <summary>
@@ -91,6 +94,8 @@ public async Task<ActionResult<CblImportSummaryDto>> ValidateCbl(IFormFile cbl,
     [SwaggerIgnore]
     public async Task<ActionResult<CblImportSummaryDto>> ImportCbl(IFormFile cbl, [FromQuery] bool dryRun = false, [FromQuery] bool useComicVineMatching = false)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         try
         {
             var userId = User.GetUserId();

API/Controllers/ChapterController.cs

@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
+using API.Constants;
 using API.Data;
 using API.Data.Repositories;
 using API.DTOs;
@@ -58,6 +59,8 @@ await _unitOfWork.ChapterRepository.GetChapterDtoAsync(chapterId,
     [HttpDelete]
     public async Task<ActionResult<bool>> DeleteChapter(int chapterId)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         var chapter = await _unitOfWork.ChapterRepository.GetChapterAsync(chapterId);
         if (chapter == null)
             return BadRequest(_localizationService.Translate(User.GetUserId(), "chapter-doesnt-exist"));

API/Controllers/CollectionController.cs

@@ -105,6 +105,8 @@ public async Task<ActionResult<bool>> DoesNameExists(string name)
     [HttpPost("update")]
     public async Task<ActionResult> UpdateTag(AppUserCollectionDto updatedTag)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         try
         {
             if (await _collectionService.UpdateTag(updatedTag, User.GetUserId()))
@@ -130,6 +132,8 @@ await _eventHub.SendMessageAsync(MessageFactory.CollectionUpdated,
     [HttpPost("promote-multiple")]
     public async Task<ActionResult> PromoteMultipleCollections(PromoteCollectionsDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         // This needs to take into account owner as I can select other users cards
         var collections = await _unitOfWork.CollectionTagRepository.GetCollectionsByIds(dto.CollectionIds);
         var userId = User.GetUserId();
@@ -161,6 +165,8 @@ public async Task<ActionResult> PromoteMultipleCollections(PromoteCollectionsDto
     [HttpPost("delete-multiple")]
     public async Task<ActionResult> DeleteMultipleCollections(DeleteCollectionsDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         // This needs to take into account owner as I can select other users cards
         var user = await _unitOfWork.UserRepository.GetUserByIdAsync(User.GetUserId(), AppUserIncludes.Collections);
         if (user == null) return Unauthorized();
@@ -182,6 +188,8 @@ public async Task<ActionResult> DeleteMultipleCollections(DeleteCollectionsDto d
     [HttpPost("update-for-series")]
     public async Task<ActionResult> AddToMultipleSeries(CollectionTagBulkAddDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         // Create a new tag and save
         var user = await _unitOfWork.UserRepository.GetUserByIdAsync(User.GetUserId(), AppUserIncludes.Collections);
         if (user == null) return Unauthorized();
@@ -223,6 +231,8 @@ public async Task<ActionResult> AddToMultipleSeries(CollectionTagBulkAddDto dto)
     [HttpPost("update-series")]
     public async Task<ActionResult> RemoveTagFromMultipleSeries(UpdateSeriesForTagDto updateSeriesForTagDto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         try
         {
             var tag = await _unitOfWork.CollectionTagRepository.GetCollectionAsync(updateSeriesForTagDto.Tag.Id, CollectionIncludes.Series);
@@ -247,6 +257,8 @@ public async Task<ActionResult> RemoveTagFromMultipleSeries(UpdateSeriesForTagDt
     [HttpDelete]
     public async Task<ActionResult> DeleteTag(int tagId)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         try
         {
             var user = await _unitOfWork.UserRepository.GetUserByIdAsync(User.GetUserId(), AppUserIncludes.Collections);
@@ -276,6 +288,8 @@ public async Task<ActionResult> DeleteTag(int tagId)
     [HttpGet("mal-stacks")]
     public async Task<ActionResult<IList<MalStackDto>>> GetMalStacksForUser()
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         return Ok(await _externalMetadataService.GetStacksForUser(User.GetUserId()));
     }
 
@@ -289,6 +303,8 @@ public async Task<ActionResult> ImportMalStack(MalStackDto dto)
     {
         var user = await _unitOfWork.UserRepository.GetUserByIdAsync(User.GetUserId(), AppUserIncludes.Collections);
         if (user == null) return Unauthorized();
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
 
         // Validation check to ensure stack doesn't exist already
         if (await _unitOfWork.CollectionTagRepository.CollectionExists(dto.Title, user.Id))

API/Controllers/FilterController.cs

@@ -2,13 +2,15 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
+using API.Constants;
 using API.Data;
 using API.Data.Repositories;
 using API.DTOs.Dashboard;
 using API.DTOs.Filtering.v2;
 using API.Entities;
 using API.Extensions;
 using API.Helpers;
+using API.Services;
 using Microsoft.AspNetCore.Mvc;
 
 namespace API.Controllers;
@@ -21,10 +23,12 @@ namespace API.Controllers;
 public class FilterController : BaseApiController
 {
     private readonly IUnitOfWork _unitOfWork;
+    private readonly ILocalizationService _localizationService;
 
-    public FilterController(IUnitOfWork unitOfWork)
+    public FilterController(IUnitOfWork unitOfWork, ILocalizationService localizationService)
     {
         _unitOfWork = unitOfWork;
+        _localizationService = localizationService;
     }
 
     /// <summary>
@@ -37,6 +41,7 @@ public async Task<ActionResult> CreateOrUpdateSmartFilter(FilterV2Dto dto)
     {
         var user = await _unitOfWork.UserRepository.GetUserByIdAsync(User.GetUserId(), AppUserIncludes.SmartFilters);
         if (user == null) return Unauthorized();
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
 
         if (string.IsNullOrWhiteSpace(dto.Name)) return BadRequest("Name must be set");
         if (Seed.DefaultStreams.Any(s => s.Name.Equals(dto.Name, StringComparison.InvariantCultureIgnoreCase)))
@@ -78,6 +83,8 @@ public ActionResult<IEnumerable<SmartFilterDto>> GetFilters()
     [HttpDelete]
     public async Task<ActionResult> DeleteFilter(int filterId)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         var filter = await _unitOfWork.AppUserSmartFilterRepository.GetById(filterId);
         if (filter == null) return Ok();
         // This needs to delete any dashboard filters that have it too

API/Controllers/PersonController.cs

@@ -9,6 +9,7 @@
 using API.Services.Tasks.Metadata;
 using API.SignalR;
 using AutoMapper;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Nager.ArticleNumber;
 
@@ -72,6 +73,7 @@ public async Task<ActionResult<PagedList<BrowsePersonDto>>> GetAuthorsForBrowse(
     /// </summary>
     /// <param name="dto"></param>
     /// <returns></returns>
+    [Authorize("AdminRequired")]
     [HttpPost("update")]
     public async Task<ActionResult<PersonDto>> UpdatePerson(UpdatePersonDto dto)
     {

API/Controllers/ReadingListController.cs

@@ -108,6 +108,7 @@ public async Task<ActionResult<IEnumerable<ReadingListItemDto>>> GetListForUser(
     [HttpPost("update-position")]
     public async Task<ActionResult> UpdateListItemPosition(UpdateReadingListPosition dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
         // Make sure UI buffers events
         var user = await _readingListService.UserHasReadingListAccess(dto.ReadingListId, User.GetUsername());
         if (user == null)
@@ -129,6 +130,7 @@ public async Task<ActionResult> UpdateListItemPosition(UpdateReadingListPosition
     [HttpPost("delete-item")]
     public async Task<ActionResult> DeleteListItem(UpdateReadingListPosition dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
         var user = await _readingListService.UserHasReadingListAccess(dto.ReadingListId, User.GetUsername());
         if (user == null)
         {
@@ -151,6 +153,8 @@ public async Task<ActionResult> DeleteListItem(UpdateReadingListPosition dto)
     [HttpPost("remove-read")]
     public async Task<ActionResult> DeleteReadFromList([FromQuery] int readingListId)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         var user = await _readingListService.UserHasReadingListAccess(readingListId, User.GetUsername());
         if (user == null)
         {
@@ -173,6 +177,7 @@ public async Task<ActionResult> DeleteReadFromList([FromQuery] int readingListId
     [HttpDelete]
     public async Task<ActionResult> DeleteList([FromQuery] int readingListId)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
         var user = await _readingListService.UserHasReadingListAccess(readingListId, User.GetUsername());
         if (user == null)
         {
@@ -193,6 +198,7 @@ public async Task<ActionResult> DeleteList([FromQuery] int readingListId)
     [HttpPost("create")]
     public async Task<ActionResult<ReadingListDto>> CreateList(CreateReadingListDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
         var user = await _unitOfWork.UserRepository.GetUserByUsernameAsync(User.GetUsername(), AppUserIncludes.ReadingLists);
         if (user == null) return Unauthorized();
 
@@ -216,6 +222,7 @@ public async Task<ActionResult<ReadingListDto>> CreateList(CreateReadingListDto
     [HttpPost("update")]
     public async Task<ActionResult> UpdateList(UpdateReadingListDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
         var readingList = await _unitOfWork.ReadingListRepository.GetReadingListByIdAsync(dto.ReadingListId);
         if (readingList == null) return BadRequest(await _localizationService.Translate(User.GetUserId(), "reading-list-doesnt-exist"));
 
@@ -245,6 +252,7 @@ public async Task<ActionResult> UpdateList(UpdateReadingListDto dto)
     [HttpPost("update-by-series")]
     public async Task<ActionResult> UpdateListBySeries(UpdateReadingListBySeriesDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
         var user = await _readingListService.UserHasReadingListAccess(dto.ReadingListId, User.GetUsername());
         if (user == null)
         {
@@ -287,6 +295,7 @@ public async Task<ActionResult> UpdateListBySeries(UpdateReadingListBySeriesDto
     [HttpPost("update-by-multiple")]
     public async Task<ActionResult> UpdateListByMultiple(UpdateReadingListByMultipleDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
         var user = await _readingListService.UserHasReadingListAccess(dto.ReadingListId, User.GetUsername());
         if (user == null)
         {
@@ -331,6 +340,7 @@ public async Task<ActionResult> UpdateListByMultiple(UpdateReadingListByMultiple
     [HttpPost("update-by-multiple-series")]
     public async Task<ActionResult> UpdateListByMultipleSeries(UpdateReadingListByMultipleSeriesDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
         var user = await _readingListService.UserHasReadingListAccess(dto.ReadingListId, User.GetUsername());
         if (user == null)
         {
@@ -369,6 +379,7 @@ public async Task<ActionResult> UpdateListByMultipleSeries(UpdateReadingListByMu
     [HttpPost("update-by-volume")]
     public async Task<ActionResult> UpdateListByVolume(UpdateReadingListByVolumeDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
         var user = await _readingListService.UserHasReadingListAccess(dto.ReadingListId, User.GetUsername());
         if (user == null)
         {
@@ -405,6 +416,7 @@ public async Task<ActionResult> UpdateListByVolume(UpdateReadingListByVolumeDto
     [HttpPost("update-by-chapter")]
     public async Task<ActionResult> UpdateListByChapter(UpdateReadingListByChapterDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
         var user = await _readingListService.UserHasReadingListAccess(dto.ReadingListId, User.GetUsername());
         if (user == null)
         {
@@ -514,6 +526,8 @@ public async Task<ActionResult<bool>> DoesNameExists(string name)
     [HttpPost("promote-multiple")]
     public async Task<ActionResult> PromoteMultipleReadingLists(PromoteReadingListsDto dto)
     {
+        if (User.IsInRole(PolicyConstants.ReadOnlyRole)) return BadRequest(await _localizationService.Translate(User.GetUserId(), "permission-denied"));
+
         // This needs to take into account owner as I can select other users cards
         var userId = User.GetUserId();
         if (!User.IsInRole(PolicyConstants.PromoteRole) && !User.IsInRole(PolicyConstants.AdminRole))