classlib/ExpenseTracker.Application/Accounts/Commands/Delete/DeleteAccountCommandAuthorizer.cs

using MediatR.Behaviors.Authorization;
using ExpenseTracker.Application.Common.Authorization;
using ExpenseTracker.Application.Common.Interfaces.Repositories;
using ExpenseTracker.Application.Common.Interfaces.Services;
using ExpenseTracker.Application.Common.Models;

namespace ExpenseTracker.Application.Accounts.Commands.Delete;

public class DeleteAccountCommandAuthorizer : AbstractRequestAuthorizer<DeleteAccountCommand>
{
    private readonly ISessionUserService _sessionUserService;
    private readonly IAccountRepository _repository;

    public DeleteAccountCommandAuthorizer(ISessionUserService currentUserService, IAccountRepository repository)
    {
        _sessionUserService = currentUserService;
        _repository = repository;
    }

    public override void BuildPolicy(DeleteAccountCommand request)
    {
        UseRequirement(new MustBeAuthenticatedRequirement
        {
            IsAuthenticated = _sessionUserService.IsAuthenticated
        });

        var requiredUserId = _repository.Queryable.FirstOrDefault(e => e.Id == request.Id)?.UserId;

        UseRequirement(new MustBeInRolesWhenInteractingWithUnOwnedEntityRequirement
        {
            UserId = _sessionUserService.Id,
            UserRoles = _sessionUserService.Roles,
            RequiredUserId = requiredUserId,
            RequiredRoles = new[] { IdentityRoles.Administrator.ToString() }
        });
    }
}