tsk-#76: Added functionality

Icarus/Controllers/Managers/TokenManager.cs

@@ -138,24 +138,30 @@ public class TokenManager : BaseManager
         return tokenUserId.Value == song.UserId;
     }
 
-    public int? RetrieveUserIdFromToken(string token)
+    public string? GetBearerToken(HttpContext context)
     {
-        if (this.ContainsBearer(token))
+        string authorizationHeader = context.Request.Headers["Authorization"]!;
+
+        if (!authorizationHeader.IsNullOrEmpty() && authorizationHeader.StartsWith("Bearer", StringComparison.OrdinalIgnoreCase))
         {
-            token = this.StripBearer(token);
+            string token = authorizationHeader.Substring("Bearer ".Length).Trim();
+            return token;
         }
 
+        return null;
+    }
+
+    public int? RetrieveUserIdFromToken(string token)
+    {
+            var parsedToken = this.ContainsBearer(token) ? this.StripBearer(token) : token;
         var tokenHandler = new JwtSecurityTokenHandler();
-        var readTok = tokenHandler.ReadJwtToken(token);
-        // var userId = -1;
+        var readTok = tokenHandler.ReadJwtToken(parsedToken);
 
         foreach (var item in readTok.Payload)
         {
             if (item.Key == "user_id")
             {
-                // userId = 
                 return Convert.ToInt32(item.Value);
-                // break;
             }
         }
 

Icarus/Controllers/v1/SongDataController.cs

@@ -38,11 +38,23 @@ public class SongDataController : BaseController
     #endregion
 
 
+
     [HttpGet("download/{id}")]
     public IActionResult Download(int id, [FromQuery] bool? randomizeFilename)
     {
-        var songContext = new SongContext(_connectionString!);
+        var tokenManager = new TokenManager(this._config!);
+        var songContext = new SongContext(this._connectionString!);
+        var accLvlContext = new AccessLevelContext(this._connectionString!);
         var songMetaData = songContext.RetrieveRecord(new Song { Id = id });
+        var accessLevel = accLvlContext.GetAccessLevel(songMetaData.Id);
+        var token = tokenManager.GetBearerToken(HttpContext);
+        if (token == null || accessLevel == null) {
+            return BadRequest();
+        }
+
+        if (!tokenManager.CanAccessSong(token, songMetaData, accessLevel)) {
+            return BadRequest();
+        }
 
         var song = _songMgr!.RetrieveSong(songMetaData).Result;
         string filename;
@@ -66,6 +78,7 @@ public class SongDataController : BaseController
         return File(song.Data!, "application/x-msdownload", filename);
     }
 
+    // NOTE: No longer being used
     // Assumes that the song already has metadata such as
     // Title
     // Artist