Ms. Aydin may edit everything, Mr. Kowalski, the technician, may read. In the old program you can see that from the grayed-out buttons: Whoever is not in the dispatch group cannot click “Save”. That is the whole permission check, and it sits in the window. This lesson carries it over to the web API and the Blazor pages. It first writes down what the old program really checks, translates that into policies and secures it with tests. You know the basics of roles and policies in ASP.NET Core from K2, module 2.6 (Signing in and permissions); what is added when you carry over a grown program is covered here.
Writing down the old permissions
Before you write a policy, read the old program for places where Permissions.CanEdit is checked, or nothing at all. The result for the Order Book (the code is in lesson M1.2):
| Place | Old check | Who may | New policy |
|---|---|---|---|
| View the order list | none | everyone | Read |
| Change orders in the table, “Save” | ReadOnly and Enabled on the form |
Dispatch | Edit |
| “Print invoice” as a button | Enabled = CanEdit |
Dispatch | Edit |
| “Print invoice” in the “File” menu | none | everyone | Edit |
| “Export to accounting” | Enabled = CanEdit |
Dispatch | Edit |
| Change customers | ReadOnly = !CanEdit |
Dispatch | Edit |
| Create a maintenance order | Enabled = CanEdit |
Dispatch | Edit |
| “Export plan for technicians” | none | everyone | Read |
the call Save() itself |
none | anyone who reaches it | Edit |
The fourth row is a find. The “Print invoice” button is disabled for technicians, the menu entry “File, Print invoice” is not, and both call the same method. It assigns an invoice number, sets the status to “Invoiced” and saves. A technician could therefore generate an invoice through the menu without the check noticing anything. Whether anyone ever did, no log knows. The error is typical of permissions that hang on controls: Every new control, every new path to the same method needs its own check, and at some point one is missing.
Do not take the error into the new system. Because generating an invoice writes, it requires Edit, no matter how the request arrives. Whether that is wanted for technicians is a business question and belongs in docs/business-department-questions.md.