fix(announcements): grant acess to all announcements for Admins and AnnouncementManagers

Author: maakinoh

src/Eurofurence.App.Backoffice/Services/AnnouncementService.cs

@@ -23,6 +23,7 @@ public async Task UpdateAnnouncementAsync(Guid id, AnnouncementRequest request)
             response.EnsureSuccessStatusCode();
         }
 
+        /// <inheritdoc />
         public async Task DeleteAnnouncementAsync(Guid id)
         {
             using var response = await http.DeleteAsync($"Announcements/{id}");

src/Eurofurence.App.Server.Services/Abstractions/Announcements/IAnnouncementService.cs

@@ -1,4 +1,7 @@
-using System.Linq;
+using System;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
 using Eurofurence.App.Domain.Model.Announcements;
 
 namespace Eurofurence.App.Server.Services.Abstractions.Announcements
@@ -7,6 +10,18 @@ public interface IAnnouncementService :
         IEntityServiceOperations<AnnouncementRecord, AnnouncementResponse>,
         IPatchOperationProcessor<AnnouncementRecord>
     {
+        /// <summary>
+        /// Fetches all announcements regardless of whether the user is a member of the group or not.
+        /// </summary>
+        /// <returns>Collection of all found records.</returns>
         public IQueryable<AnnouncementRecord> FetchAll();
+
+        /// <summary>
+        /// Finds an announcement by its id regardless of whether the user is a member of the group or not.
+        /// </summary>
+        /// <param name="id">The id to look up.</param>
+        /// <param name="cancellationToken"></param>
+        /// <returns>A task with the record. Can be null.</returns>
+        public Task<AnnouncementRecord> FindOneInAllAsync(Guid id, CancellationToken cancellationToken = default);
     }
 }

src/Eurofurence.App.Server.Services/Announcements/AnnouncementService.cs

@@ -37,11 +37,19 @@ IIdentityService identityService
             _identityService = identityService;
         }
 
+        /// <inheritdoc />
         public IQueryable<AnnouncementRecord> FetchAll()
         {
             return _appDbContext.Announcements.AsNoTracking();
         }
 
+        /// <inheritdoc />
+        public async Task<AnnouncementRecord> FindOneInAllAsync(Guid id, CancellationToken cancellationToken = default)
+        {
+            return await _appDbContext.Announcements.AsNoTracking().FirstOrDefaultAsync(entity => entity.Id == id, cancellationToken);
+        }
+
+        /// <inheritdoc />
         public override async Task<AnnouncementRecord> FindOneAsync(Guid id, CancellationToken cancellationToken = default)
         {
             return await FindAll()

src/Eurofurence.App.Server.Web/Controllers/AnnouncementsController.cs

@@ -87,7 +87,7 @@ public async Task<AnnouncementResponse> GetAnnouncementAsync([FromRoute] Guid id
         [ProducesResponseType(typeof(string), 404)]
         public async Task<ActionResult> DeleteAnnouncementAsync([FromRoute] Guid id)
         {
-            if (await _announcementService.FindOneAsync(id) == null) return NotFound();
+            if (await QueryRecordForIdAsync(id) == null) return NotFound();
 
             await _announcementService.DeleteOneAsync(id);
             await _pushNotificationChannelManager.PushSyncRequestAsync();
@@ -146,7 +146,9 @@ public async Task<ActionResult> PutAnnouncementAsync([FromRoute] Guid id,
                 return BadRequest("Error parsing request");
             }
 
-            if (await _announcementService.FindOneAsync(id) is not { } announcementRecord)
+            AnnouncementRecord record = await QueryRecordForIdAsync(id);
+
+            if (record is not { } announcementRecord)
             {
                 return NotFound();
             }
@@ -160,6 +162,29 @@ public async Task<ActionResult> PutAnnouncementAsync([FromRoute] Guid id,
             return NoContent();
         }
 
+        /// <summary>
+        /// Returns the announcement record for the given id.
+        /// If the user is an admin or announcement manager, the record is returned regardless of whether
+        /// they are a member of the groups or not.
+        /// </summary>
+        /// <param name="id">The id to look up.</param>
+        /// <returns>Task with the record. Can be null.</returns>
+        private async Task<AnnouncementRecord> QueryRecordForIdAsync(Guid id)
+        {
+            AnnouncementRecord record;
+
+            if (User.IsInRole(IdentityRoles.Admin) ||
+                User.IsInRole(IdentityRoles.AnnouncementManager))
+            {
+                record = await _announcementService.FindOneInAllAsync(id);
+            }
+            else
+            {
+                record = await _announcementService.FindOneAsync(id);
+            }
+            return record;
+        }
+
         /// <summary>
         /// !DANGER! – Deletes all announcements from the database!
         /// </summary>