♻️ Refactored permission service

DysonNetwork.Pass/Permission/PermissionMiddleware.cs

@@ -1,6 +1,7 @@
 namespace DysonNetwork.Pass.Permission;
 
 using System;
+using Microsoft.Extensions.Logging;
 using DysonNetwork.Shared.Models;
 
 [AttributeUsage(AttributeTargets.Method)]
@@ -10,8 +11,11 @@ public class RequiredPermissionAttribute(string area, string key) : Attribute
     public string Key { get; } = key;
 }
 
-public class PermissionMiddleware(RequestDelegate next)
+public class PermissionMiddleware(RequestDelegate next, ILogger<PermissionMiddleware> logger)
 {
+    private const string ForbiddenMessage = "Insufficient permissions";
+    private const string UnauthorizedMessage = "Authentication required";
+
     public async Task InvokeAsync(HttpContext httpContext, PermissionService pm)
     {
         var endpoint = httpContext.GetEndpoint();
@@ -22,31 +26,59 @@ public class PermissionMiddleware(RequestDelegate next)
 
         if (attr != null)
         {
+            // Validate permission attributes
+            if (string.IsNullOrWhiteSpace(attr.Area) || string.IsNullOrWhiteSpace(attr.Key))
+            {
+                logger.LogWarning("Invalid permission attribute: Area='{Area}', Key='{Key}'", attr.Area, attr.Key);
+                httpContext.Response.StatusCode = StatusCodes.Status500InternalServerError;
+                await httpContext.Response.WriteAsync("Server configuration error");
+                return;
+            }
+
             if (httpContext.Items["CurrentUser"] is not SnAccount currentUser)
             {
-                httpContext.Response.StatusCode = StatusCodes.Status403Forbidden;
-                await httpContext.Response.WriteAsync("Unauthorized");
+                logger.LogWarning("Permission check failed: No authenticated user for {Area}/{Key}", attr.Area, attr.Key);
+                httpContext.Response.StatusCode = StatusCodes.Status401Unauthorized;
+                await httpContext.Response.WriteAsync(UnauthorizedMessage);
                 return;
             }
 
             if (currentUser.IsSuperuser)
             {
                 // Bypass the permission check for performance
+                logger.LogDebug("Superuser {UserId} bypassing permission check for {Area}/{Key}",
+                    currentUser.Id, attr.Area, attr.Key);
                 await next(httpContext);
                 return;
             }
 
             var actor = $"user:{currentUser.Id}";
-            var permNode = await pm.GetPermissionAsync<bool>(actor, attr.Area, attr.Key);
-
-            if (!permNode)
+            try
             {
-                httpContext.Response.StatusCode = StatusCodes.Status403Forbidden;
-                await httpContext.Response.WriteAsync($"Permission {attr.Area}/{attr.Key} = {true} was required.");
+                var permNode = await pm.GetPermissionAsync<bool>(actor, attr.Area, attr.Key);
+
+                if (!permNode)
+                {
+                    logger.LogWarning("Permission denied for user {UserId}: {Area}/{Key}",
+                        currentUser.Id, attr.Area, attr.Key);
+                    httpContext.Response.StatusCode = StatusCodes.Status403Forbidden;
+                    await httpContext.Response.WriteAsync(ForbiddenMessage);
+                    return;
+                }
+
+                logger.LogDebug("Permission granted for user {UserId}: {Area}/{Key}",
+                    currentUser.Id, attr.Area, attr.Key);
+            }
+            catch (Exception ex)
+            {
+                logger.LogError(ex, "Error checking permission for user {UserId}: {Area}/{Key}",
+                    currentUser.Id, attr.Area, attr.Key);
+                httpContext.Response.StatusCode = StatusCodes.Status500InternalServerError;
+                await httpContext.Response.WriteAsync("Permission check failed");
                 return;
             }
         }
 
         await next(httpContext);
-    } 
-}
+    }
+}