How to hide Dynamic Web Api from Swagger UI documentation #4380

3 Answer(s)

• 

  0

  bbakermmc created 6 years ago

  We created our own attribute/filter for swagger. It will show the endpoint the user has permissions too. You should be able to adapt it to show none :D

  public class SwaggerAbpAuthorizeAttributeAuthorizationFilter : IDocumentFilter
      {
          private readonly IPermissionChecker _permissionChecker;
  
          public SwaggerAbpAuthorizeAttributeAuthorizationFilter(IPermissionChecker permissionChecker)
          {
              _permissionChecker = permissionChecker;
          }
  
          public void Apply(SwaggerDocument swaggerDoc, DocumentFilterContext context)
          {
              var descriptions = context.ApiDescriptionsGroups.Items.SelectMany(group => group.Items);
  
              foreach (var description in descriptions)
              {
                  var route = "/" + description.RelativePath.TrimEnd('/');
                  var path = swaggerDoc.Paths[route];
  
                  var controllerAbpAuthorizeAttributes = description.ControllerAttributes()
                      .OfType<AbpAuthorizeAttribute>().ToList();
  
                  var actionAbpAuthorizeAttributes = description.ActionAttributes()
                      .OfType<AbpAuthorizeAttribute>().ToList();
  
                  var hideSwaggerList = description.ActionAttributes()
                      .OfType<SwaggerHide>().ToList();
  
                  var isHideSwagger = hideSwaggerList.Any();
                  
                  if (isHideSwagger)
                  {
                      swaggerDoc.Paths.Remove(route);
                  }
  
                  var authAttributes = new List<AbpAuthorizeAttribute>();
  
                  if (actionAbpAuthorizeAttributes.Count > 0)
                      authAttributes = actionAbpAuthorizeAttributes;
                  else if (controllerAbpAuthorizeAttributes.Count > 0)
                      authAttributes = controllerAbpAuthorizeAttributes;
  
                  // check if this action should be visible
                  var forbiddenDuePermissions = IsForbiddenDuePermissions(authAttributes);
  
                  if (!forbiddenDuePermissions)
                      continue; // user passed all permissions checks
  
                  // remove method or entire path (if there are no more methods in this path)
                  switch (description.HttpMethod)
                  {
                      case "DELETE":
                          path.Delete = null;
                          break;
                      case "GET":
                          path.Get = null;
                          break;
                      case "HEAD":
                          path.Head = null;
                          break;
                      case "OPTIONS":
                          path.Options = null;
                          break;
                      case "PATCH":
                          path.Patch = null;
                          break;
                      case "POST":
                          path.Post = null;
                          break;
                      case "PUT":
                          path.Put = null;
                          break;
                      default: throw new ArgumentOutOfRangeException("Method name not mapped to operation");
                  }
  
                  if (path.Delete == null && path.Get == null &&
                      path.Head == null && path.Options == null &&
                      path.Patch == null && path.Post == null && path.Put == null)
                      swaggerDoc.Paths.Remove(route);
  
                  
              }
          }
  
          private bool IsForbiddenDuePermissions(IEnumerable<AbpAuthorizeAttribute> attributes)
          {
              var authorizeAttributes = attributes
                  .Where(p => p.Permissions != null).ToList();
  
              var permissions = new List<string>();
              if (authorizeAttributes.Count != 0)
                  foreach (var authorizeAttribute in authorizeAttributes)
                      permissions.AddRange(authorizeAttribute.Permissions.ToList());
              else
                  return true;
  
              foreach (var permission in permissions)
              {
                  var allow = _permissionChecker.IsGranted(permission);
                  if (allow)
                      return false;
              }
  
              return true;
          }
      }
  

  Save Cancel
• 

  0

  banksearch created 6 years ago

  Thanks for the code. It helped me to find a way to hide all. I have created a custom attribute as ShowSwagger and onyl shows the services that has the ShowSwagger.

  Save Cancel
• 

  0

  alper created 6 years ago

  Support Team

  thanks for your share @BBakerMMC

  Save Cancel