add authorization checks

Author: damienmoulard

Diff for: Zenergy/Zenergy/Controllers/ApiControllers/membersController.cs

@@ -63,6 +63,7 @@ public async Task<IHttpActionResult> Postmember(member member)
 
         // DELETE: api/members/5
         [ResponseType(typeof(member))]
+        [Authorize(Roles = "Admin")]
         public async Task<IHttpActionResult> Deletemember(int id)
         {
             member member = await db.member.FindAsync(id);

Diff for: Zenergy/Zenergy/Controllers/ApiControllers/usersController.cs

@@ -26,12 +26,14 @@ public usersController()
         }
 
         // GET: api/users
+        [Authorize(Roles = "Admin")]
         public IQueryable<user> Getuser()
         {
             return db.user;
         }
 
         // GET: api/users/5
+        [Authorize(Roles = "Admin")]
         [ResponseType(typeof(user))]
         public async Task<IHttpActionResult> Getuser(int id)
         {
@@ -62,6 +64,7 @@ public async Task<IHttpActionResult> findByMail(string userMail)
         [Route("api/users/findByRole")]
         [HttpGet]
         [ResponseType(typeof(user[]))]
+        [Authorize(Roles = "Admin, Manager")]
         public async Task<IHttpActionResult> findByRole(string role) {
             user[] users = null;
 
@@ -126,6 +129,7 @@ public async Task<IHttpActionResult> Putuser(int id, user user)
 
         // POST: api/users
         [ResponseType(typeof(user))]
+        [AllowAnonymous]
         public async Task<IHttpActionResult> Postuser(user user)
         {
             if (!ModelState.IsValid)
@@ -141,6 +145,7 @@ public async Task<IHttpActionResult> Postuser(user user)
 
         // DELETE: api/users/5
         [ResponseType(typeof(user))]
+        [Authorize(Roles = "Admin")]
         public async Task<IHttpActionResult> Deleteuser(int id)
         {
             user user = await db.user.FindAsync(id);