Use incremental consent for User.ReadBasic.All

DFE-Digital · Oct 24, 2023 · 9f40a67 · 9f40a67
1 parent d034b8f
commit 9f40a67
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 1 deletion.
diff --git a/...hingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Confirm.cshtml.cs b/...hingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Confirm.cshtml.cs
@@ -2,12 +2,14 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.AspNetCore.Mvc.RazorPages;
+using Microsoft.Identity.Web;
 using TeachingRecordSystem.Core.DataStore.Postgres;
 using TeachingRecordSystem.Core.Events;
 using TeachingRecordSystem.SupportUi.Services.AzureActiveDirectory;
 
 namespace TeachingRecordSystem.SupportUi.Pages.Users.AddUser;
 
+[AuthorizeForScopes(Scopes = new[] { "User.ReadBasic.All" })]
 public class ConfirmModel : PageModel
 {
     private readonly TrsDbContext _dbContext;

diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Index.cshtml.cs b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Index.cshtml.cs
@@ -2,11 +2,13 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.RazorPages;
+using Microsoft.Identity.Web;
 using TeachingRecordSystem.SupportUi.Services.AzureActiveDirectory;
 
 namespace TeachingRecordSystem.SupportUi.Pages.Users.AddUser;
 
 [Authorize(Roles = UserRoles.Administrator)]
+[AuthorizeForScopes(Scopes = new[] { "User.ReadBasic.All" })]
 public class IndexModel : PageModel
 {
     private readonly IAadUserService _userService;

diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Program.cs b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Program.cs
@@ -70,7 +70,7 @@
 
 if (!builder.Environment.IsUnitTests() && !builder.Environment.IsEndToEndTests())
 {
-    var graphApiScopes = new[] { "User.Read", "User.ReadBasic.All" };
+    var graphApiScopes = new[] { "User.Read" };
 
     builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
         .AddMicrosoftIdentityWebApp(builder.Configuration, "AzureAd")