Update auth role and envelopeId check in CreateAsync
Changed [Authorize] to require Receiver.FullyAuth role for CreateAsync, restricting access to receiver users. Removed explicit null check and logging for envelopeId claim, allowing the method to proceed without this validation.
This commit is contained in:
@@ -37,7 +37,7 @@ public class ReadOnlyController : ControllerBase
|
||||
/// </summary>
|
||||
/// <param name="createDto">Creation payload.</param>
|
||||
[HttpPost]
|
||||
[Authorize(Roles = Role.FullyAuth)]
|
||||
[Authorize(Roles = Role.Receiver.FullyAuth)]
|
||||
public async Task<IActionResult> CreateAsync([FromBody] EnvelopeReceiverReadOnlyCreateDto createDto)
|
||||
{
|
||||
var authReceiverMail = User.GetAuthReceiverMail();
|
||||
@@ -48,11 +48,6 @@ public class ReadOnlyController : ControllerBase
|
||||
}
|
||||
|
||||
var envelopeId = User.GetAuthEnvelopeId();
|
||||
if (envelopeId is null)
|
||||
{
|
||||
_logger.LogError("Envelope Id claim is not found in envelope-receiver-read-only creation process. Create DTO is:\n {dto}", JsonConvert.SerializeObject(createDto));
|
||||
return Unauthorized();
|
||||
}
|
||||
|
||||
createDto.AddedWho = authReceiverMail;
|
||||
createDto.EnvelopeId = envelopeId;
|
||||
|
||||
Reference in New Issue
Block a user