Authorization failure in constructor of AppService

• Your Abp package version: 3.5.0
• Your base framework: .Net Framework or .Net Core: 2.0.1

Description:

Adding AbpAuthorizeAttribute to an app service that calls setters in its constructor will fail to proxy unless the user has been granted the permission required by the authorize attribute on the class.

To reproduce:

[AbpAuthorize("Users.Update")]
public class UserAppService : AsyncCrudAppService<User, ...>
{
    public UserAppService(/*omitted for brevity*/) 
    {
        // The call to `set_UpdatePermissionName` here is what throws the authorization exception.
        UpdatePermissionName = "Users.Update";
    }
}

public class SomeController
{
    private readonly UserAppService _userAppService;

    public SomeController(IUserAppService userAppService)
    {
        _userappService = userAppService;
    }

    // This method should be able to execute without the "Users.Update" permission
    public IActionResult ShouldWorkAction()
    {
        /* Does not require _userAppService */
    }

    [AbpAuthorize("Users.Update")]
    public IActionResult OtherAction()
    {
        /* Uses a _userAppService method */
    }
}

In the example above OtherAction is the only method requiring the UserAppService instance. Obviously, if the user has the requisite permissions, the controller will instantiate without a problem. The issue arises when the user has not been granted “Users.Update”. The failure occurs when Castle’s AbstractInvocation is intercepted by the Abp’s AuthorizationInterceptor during the call to the set_UpdatePermissionName method, causing a ComponentActivatorException.

I believe what should happen, is the constructor should be able to call whatever methods it needs (since they should not have side-effects in practice), without being intercepted.

[acjh]

This works with existing syntax and no need to replace IAuthorizationHelper:

[AbpAuthorize("Users.Update")]
public class UserAppService : AsyncCrudAppService<User, ...>
{
    protected override string UpdatePermissionName { get => base.UpdatePermissionName; [AbpAllowAnonymous] set => base.UpdatePermissionName = value; }

    public UserAppService(/*omitted for brevity*/) 
    {
        UpdatePermissionName = "Users.Update";
    }
}

[gpcaretti]

@ismcagdas

If you make your CreateFilteredQuery method virtual, it will not work I guess.

CreateFilteredQuery is virtual by design as my TaskAppService is derived from Abp.Application.Services.CrudAppServiceBase<…>.

So, IMHO protected methods should not affected by the Authorize attribute of the Application Service class. Only public methods should be affected by it.

I solved the problem by overriding the default AuthorizationHelper:

    /// <summary>
    ///     Override the [AbpAuthorize] attribute for skipping protected methods.
    ///     The default [AbpAuthorize] on the class apply the attribute to both public and protected method.
    ///     This override skip protected methods
    /// </summary>
    public class MyAuthorizationHelper : AuthorizationHelper {

        public MyAuthorizationHelper(
            IFeatureChecker featureChecker,
            IAuthorizationConfiguration authConfiguration)
            : base(featureChecker, authConfiguration) {
        }

        /// <summary>
        /// Override the method for implementing the indicated logic
        /// </summary>
        public override Task AuthorizeAsync(MethodInfo methodInfo, Type type) {
            if (methodInfo.IsPublic) return base.AuthorizeAsync(methodInfo, type);

            // Gp - if methods is internal do not apply the attribute
            if (methodInfo.IsVirtual && methodInfo.IsFamily) {
                return Task.CompletedTask;
            }

            return base.AuthorizeAsync(methodInfo, type);
        }
    }