Owner Access

OwnerAccess.cs

namespace PMVProxy.API.Middleware
{
    using Hl7.Fhir.Model;
    ...

    internal class OwnerAccess : IAccessByRole
    {
        ...

        public async System.Threading.Tasks.Task Access<TResource>(TResource resource, 
            string userFhirId, IFhirService fhirService) where TResource : Resource
        {
            var resourceSubject = GetResourceSubjectProperty(resource);
            if (String.IsNullOrEmpty(resourceSubject))
            {
                _logger.LogWarning($"resource does not have a subject");
                throw new UnprocessableInputException($"resource does not have a subject");
            }
            if (resourceSubject.ToString().Equals(userFhirId, System.StringComparison.OrdinalIgnoreCase))
            {
                _logger.LogInformation($"user {userFhirId} is the subject of resource {resource.Id}");
                return;
            }
            else
            {
                _logger.LogWarning($"user {userFhirId} does not have access to {resource.Id}");
                throw new AuthorizationException("you do not have access to this resource");
            }
        }
    }
}