some code cleanup

Controllers/Vehicle/ReportController.cs

@@ -185,14 +185,14 @@ namespace CarCareTracker.Controllers
             };
             return PartialView("_Collaborators", viewModel);
         }
-        [TypeFilter(typeof(CollaboratorFilter))]
+        [TypeFilter(typeof(StrictCollaboratorFilter), Arguments = new object[] {false, true})]
         [HttpPost]
         public IActionResult AddCollaboratorsToVehicle(int vehicleId, string username)
         {
             var result = _userLogic.AddCollaboratorToVehicle(vehicleId, username);
             return Json(result);
         }
-        [TypeFilter(typeof(CollaboratorFilter))]
+        [TypeFilter(typeof(StrictCollaboratorFilter), Arguments = new object[] { false, true })]
         [HttpPost]
         public IActionResult DeleteCollaboratorFromVehicle(int userId, int vehicleId)
         {

Controllers/VehicleController.cs

@@ -151,14 +151,10 @@ namespace CarCareTracker.Controllers
                 return Json(false);
             }
         }
-        [TypeFilter(typeof(CollaboratorFilter))]
         [HttpPost]
+        [TypeFilter(typeof(StrictCollaboratorFilter), Arguments = new object[] { false, true })]
         public IActionResult DeleteVehicle(int vehicleId)
         {
-            if (!_userLogic.UserCanDirectlyEditVehicle(GetUserID(), vehicleId))
-            {
-                return Json(false);
-            }
             //Delete all service records, gas records, notes, etc.
             var result = _gasRecordDataAccess.DeleteAllGasRecordsByVehicleId(vehicleId) &&
                 _serviceRecordDataAccess.DeleteAllServiceRecordsByVehicleId(vehicleId) &&
@@ -179,15 +175,14 @@ namespace CarCareTracker.Controllers
             {
                 StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.Generic(string.Empty, "vehicle.delete", User.Identity.Name, vehicleId.ToString()));
             }
-            return Json(result);
+            return Json(OperationResponse.Succeed());
         }
         [HttpPost]
+        [TypeFilter(typeof(StrictCollaboratorFilter), Arguments = new object[] { true, true })]
         public IActionResult DeleteVehicles(List<int> vehicleIds)
         {
             List<bool> results = new List<bool>();
             foreach (int vehicleId in vehicleIds)
-            { 
-                if (_userLogic.UserCanDirectlyEditVehicle(GetUserID(), vehicleId))
             {
                 //Delete all service records, gas records, notes, etc.
                 var result = _gasRecordDataAccess.DeleteAllGasRecordsByVehicleId(vehicleId) &&
@@ -210,27 +205,21 @@ namespace CarCareTracker.Controllers
                     StaticHelper.NotifyAsync(_config.GetWebHookUrl(), WebHookPayload.Generic(string.Empty, "vehicle.delete", User.Identity.Name, vehicleId.ToString()));
                 }
                 results.Add(result);
-                } else
-                {
-                    results.Add(false);
             }
-            }
+            return Json(OperationResponse.Conditional(results.Any() && results.All(x => x), "", StaticHelper.GenericErrorMessage));
-            return Json(results.All(x => x));
         }
         [HttpPost]
+        [TypeFilter(typeof(StrictCollaboratorFilter), Arguments = new object[] { true, true })]
         public IActionResult GetVehiclesCollaborators(List<int> vehicleIds)
         {
             var viewModel = new UserCollaboratorViewModel();
             if (vehicleIds.Count() == 1)
             {
                 //only one vehicle to manage
-                if (_userLogic.UserCanDirectlyEditVehicle(GetUserID(), vehicleIds.First()))
+                if (_userLogic.UserCanEditVehicle(GetUserID(), vehicleIds.First()))
                 {
                     viewModel.CommonCollaborators = _userLogic.GetCollaboratorsForVehicle(vehicleIds.First()).Select(x => x.UserName).ToList();
                     viewModel.VehicleIds.Add(vehicleIds.First());
-                } else
-                {
-                    viewModel.CanModifyCollaborators = false;
                 }
             }
             else
@@ -238,14 +227,11 @@ namespace CarCareTracker.Controllers
                 List<UserCollaborator> allCollaborators = new List<UserCollaborator>();
                 foreach (int vehicleId in vehicleIds)
                 {
-                    if (_userLogic.UserCanDirectlyEditVehicle(GetUserID(), vehicleId))
+                    if (_userLogic.UserCanEditVehicle(GetUserID(), vehicleId))
                     {
                         var vehicleCollaborators = _userLogic.GetCollaboratorsForVehicle(vehicleId);
                         allCollaborators.AddRange(vehicleCollaborators);
                         viewModel.VehicleIds.Add(vehicleId);
-                    } else
-                    {
-                        viewModel.CanModifyCollaborators = false;
                     }
                 }
                 var groupedCollaborations = allCollaborators.GroupBy(x => x.UserName);
@@ -255,6 +241,7 @@ namespace CarCareTracker.Controllers
             return PartialView("_UserCollaborators", viewModel);
         }
         [HttpPost]
+        [TypeFilter(typeof(StrictCollaboratorFilter), Arguments = new object[] { true, true })]
         public IActionResult AddCollaboratorsToVehicles(List<string> usernames, List<int> vehicleIds)
         {
             List<OperationResponse> results = new List<OperationResponse>();
@@ -274,6 +261,7 @@ namespace CarCareTracker.Controllers
             return Json(OperationResponse.Succeed());
         }
         [HttpPost]
+        [TypeFilter(typeof(StrictCollaboratorFilter), Arguments = new object[] { true, true })]
         public IActionResult RemoveCollaboratorsFromVehicles(List<string> usernames, List<int> vehicleIds)
         {
             List<OperationResponse> results = new List<OperationResponse>();
@@ -292,37 +280,6 @@ namespace CarCareTracker.Controllers
             }
             return Json(OperationResponse.Succeed());
         }
-        [HttpPost]
-        public IActionResult DuplicateVehicleCollaborators(int sourceVehicleId, int destVehicleId)
-        {
-            try
-            {
-                //retrieve collaborators for both source and destination vehicle id.
-                if (_userLogic.UserCanEditVehicle(GetUserID(), sourceVehicleId) && _userLogic.UserCanEditVehicle(GetUserID(), destVehicleId))
-                {
-                    var sourceCollaborators = _userLogic.GetCollaboratorsForVehicle(sourceVehicleId).Select(x => x.UserVehicle.UserId).ToList();
-                    var destCollaborators = _userLogic.GetCollaboratorsForVehicle(destVehicleId).Select(x => x.UserVehicle.UserId).ToList();
-                    sourceCollaborators.RemoveAll(x => destCollaborators.Contains(x));
-                    if (sourceCollaborators.Any())
-                    {
-                        foreach (int collaboratorId in sourceCollaborators)
-                        {
-                            _userLogic.AddUserAccessToVehicle(collaboratorId, destVehicleId);
-                        }
-                    }
-                    else
-                    {
-                        return Json(OperationResponse.Failed("Both vehicles already have identical collaborators"));
-                    }
-                }
-                return Json(OperationResponse.Succeed("Collaborators Copied"));
-            }
-            catch (Exception ex)
-            {
-                _logger.LogError(ex.Message);
-                return Json(OperationResponse.Failed());
-            }
-        }
 
         #region "Shared Methods"
         [HttpPost]

Filter/StrictCollaboratorFilter.cs

@@ -0,0 +1,71 @@
+using CarCareTracker.Helper;
+using CarCareTracker.Logic;
+using CarCareTracker.Models;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using System.Security.Claims;
+
+namespace CarCareTracker.Filter
+{
+    public class StrictCollaboratorFilter: ActionFilterAttribute
+    {
+        private readonly IUserLogic _userLogic;
+        private readonly IConfigHelper _config;
+        private readonly bool _multiple;
+        private readonly bool _jsonResponse;
+        public StrictCollaboratorFilter(IUserLogic userLogic, IConfigHelper config, bool? multiple = false, bool? jsonResponse = false) {
+            _userLogic = userLogic;
+            _config = config;
+            _multiple = multiple ?? false;
+            _jsonResponse = jsonResponse ?? false;
+        }
+        public override void OnActionExecuting(ActionExecutingContext filterContext)
+        {
+            if (!filterContext.HttpContext.User.IsInRole(nameof(UserData.IsRootUser)))
+            {
+                List<int> vehicleIds = new List<int>();
+                if (!_multiple && filterContext.ActionArguments.ContainsKey("vehicleId"))
+                {
+                    vehicleIds.Add(int.Parse(filterContext.ActionArguments["vehicleId"].ToString()));
+                }
+                else if (_multiple && filterContext.ActionArguments.ContainsKey("vehicleIds"))
+                {
+                    vehicleIds.AddRange(filterContext.ActionArguments["vehicleIds"] as List<int>);
+                }
+
+                if (vehicleIds.Any())
+                {
+                    foreach (int vehicleId in vehicleIds)
+                    {
+                        if (vehicleId != default)
+                        {
+                            var userId = int.Parse(filterContext.HttpContext.User.FindFirstValue(ClaimTypes.NameIdentifier));
+                            if (!_userLogic.UserCanDirectlyEditVehicle(userId, vehicleId))
+                            {
+                                filterContext.Result = _jsonResponse ? new JsonResult(OperationResponse.Failed("Access Denied")) : new RedirectResult("/Error/Unauthorized");
+                            }
+                        }
+                        else
+                        {
+                            var shopSupplyEndpoints = new List<string> { "ImportToVehicleIdFromCsv", "GetSupplyRecordsByVehicleId", "ExportFromVehicleToCsv" };
+                            if (shopSupplyEndpoints.Contains(filterContext.RouteData.Values["action"].ToString()) && !_config.GetServerEnableShopSupplies())
+                            {
+                                //user trying to access shop supplies but shop supplies is not enabled by root user.
+                                filterContext.Result = _jsonResponse ? new JsonResult(OperationResponse.Failed("Access Denied")) : new RedirectResult("/Error/Unauthorized");
+                            }
+                            else if (!shopSupplyEndpoints.Contains(filterContext.RouteData.Values["action"].ToString()))
+                            {
+                                //user trying to access any other endpoints using 0 as vehicle id.
+                                filterContext.Result = _jsonResponse ? new JsonResult(OperationResponse.Failed("Access Denied")) : new RedirectResult("/Error/Unauthorized");
+                            }
+                        }
+                    }
+                }
+                else
+                {
+                    filterContext.Result = _jsonResponse ? new JsonResult(OperationResponse.Failed("Access Denied")) : new RedirectResult("/Error/Unauthorized");
+                }
+            }
+        }
+    }
+}

Models/User/UserCollaboratorViewModel.cs

@@ -5,6 +5,5 @@
         public List<int> VehicleIds { get; set; } = new List<int>();
         public List<string> CommonCollaborators { get; set; } = new List<string>();
         public List<string> PartialCollaborators { get; set; } = new List<string>();
-        public bool CanModifyCollaborators { get; set; } = true;
     }
 }

Views/Vehicle/_UserCollaborators.cshtml

@@ -11,8 +11,6 @@
     <h5 class="modal-title" id="userCollaboratorsModalLabel">@translator.Translate(userLanguage, "Manage Collaborators")</h5>
     <button type="button" class="btn-close" onclick="hideCollaboratorsModal()" aria-label="Close"></button>
 </div>
-@if (Model.CanModifyCollaborators)
-{
 <div class="modal-body">
     @if (showTwoColumns)
     {
@@ -108,16 +106,3 @@
     }
     adjustCollaboratorsModalSize(@showTwoColumns.ToString().ToLower());
     </script>
-} 
-else
-{
-    <div class="modal-body">
-        <div class="row">
-            <div class="col-12">
-                <div class="d-flex justify-content-center">
-                    <span class="lead text-center">@translator.Translate(userLanguage, "You don't have access to manage collaborators for these vehicles")</span>
-                </div>
-            </div>
-        </div>
-    </div>
-}

wwwroot/js/garage.js

@@ -365,10 +365,12 @@ function deleteVehicles(vehicleIds) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post('/Vehicle/DeleteVehicles', { vehicleIds: vehicleIds }, function (data) {
-                if (!data) {
+                if (data.success) {
-                    errorToast(genericErrorMessage());
-                }
                     loadGarage();
+                }
+                else {
+                    errorToast(data.message);
+                }
             })
         }
     });
@@ -378,7 +380,9 @@ function manageCollaborators(vehicleIds) {
         return;
     }
     $.post('/Vehicle/GetVehiclesCollaborators', { vehicleIds: vehicleIds }, function (data) {
-        if (data) {
+        if (isOperationResponse(data)) {
+            return;
+        } else if (data) {
             $("#userCollaboratorsModalContent").html(data);
             $("#userCollaboratorsModal").modal('show');
         }

wwwroot/js/shared.js

@@ -1813,3 +1813,12 @@ function handleAttachmentCopyLink(e) {
     navigator.clipboard.writeText(textToCopy);
     successToast("Copied Link to Clipboard");
 }
+function isOperationResponse(result) {
+    //checks if response from controller is operationresponse
+    if (result.success != undefined && result.message != undefined) {
+        if (!result.success) {
+            errorToast(result.message);
+        }
+        return true;
+    }
+}

wwwroot/js/vehicle.js

@@ -219,10 +219,10 @@ function deleteVehicle(vehicleId) {
     }).then((result) => {
         if (result.isConfirmed) {
             $.post('/Vehicle/DeleteVehicle', { vehicleId: vehicleId }, function (data) {
-                if (data) {
+                if (data.success) {
                     window.location.href = '/Home';
                 } else {
-                    errorToast(genericErrorMessage());
+                    errorToast(data.message);
                 }
             })
         }