ASP.NET Core 申請・承認機能を作る② 下書き保存と申請API

public interface IApprovalStore
{
    Task<IApprovalSession> OpenAsync(
        Guid organizationId, Guid actorId, Guid? requestId, CancellationToken ct);
}

public interface IApprovalSession : IAsyncDisposable
{
    Member? Member { get; }
    ApprovalRequest? Request { get; }
    Task InsertAsync(ApprovalRequest item, CancellationToken ct);
    Task SaveAsync(ApprovalRequest before, ApprovalRequest after, CancellationToken ct);
    Task AppendHistoryAsync(ApprovalHistory history, CancellationToken ct);
    Task CommitAsync(CancellationToken ct);
}

public sealed record EditApproval(string Title, string Description, long ExpectedVersion);
public sealed record VersionInput(long ExpectedVersion);
public sealed record RejectApproval(long ExpectedVersion, string Reason);
public sealed record ApprovalDetail(
    Guid Id, string Title, string Description, string Status,
    long Version, string? DecisionReason, AllowedActions AllowedActions);

public sealed partial class ApprovalService(IApprovalStore store)
{
    private static Member RequireMember(IApprovalSession session) =>
        session.Member ?? throw new WorkflowError(403, "membership_required");

    private static ApprovalRequest RequireVisible(IApprovalSession session, Member member)
    {
        var item = session.Request;
        if (item is null || !ApprovalPolicy.CanView(item, member))
            throw new WorkflowError(404, "request_not_found");
        return item;
    }

    private static ApprovalDetail ToDetail(ApprovalRequest item, Member member) =>
        new(item.Id, item.Title, item.Description, item.Status.ToString(),
            item.Version, item.DecisionReason, ApprovalPolicy.GetActions(item, member));

    private static void CheckVersion(ApprovalRequest item, long expectedVersion)
    {
        if (item.Version != expectedVersion)
            throw new WorkflowError(409, "request_changed");
    }

    public async Task<ApprovalDetail> GetAsync(
        Guid org, Guid actor, Guid id, CancellationToken ct)
    {
        await using var session = await store.OpenAsync(org, actor, id, ct);
        var member = RequireMember(session);
        return ToDetail(RequireVisible(session, member), member);
    }

    public async Task<ApprovalDetail> CreateAsync(Guid org, Guid actor, CancellationToken ct)
    {
        await using var session = await store.OpenAsync(org, actor, null, ct);
        var member = RequireMember(session);
        var item = new ApprovalRequest(Guid.NewGuid(), org, actor, "", "",
            ApprovalStatus.Draft, 1, null);
        await session.InsertAsync(item, ct);
        await session.AppendHistoryAsync(new(item.Id, 1, actor, "created",
            ApprovalStatus.Draft, ApprovalStatus.Draft, null, DateTimeOffset.UtcNow), ct);
        await session.CommitAsync(ct);
        return ToDetail(item, member);
    }

    public async Task<ApprovalDetail> EditAsync(
        Guid org, Guid actor, Guid id, EditApproval input, CancellationToken ct)
    {
        await using var session = await store.OpenAsync(org, actor, id, ct);
        var member = RequireMember(session);
        var item = RequireVisible(session, member);
        CheckVersion(item, input.ExpectedVersion);
        if (!ApprovalPolicy.GetActions(item, member).CanEdit)
            throw new WorkflowError(403, "edit_not_allowed");
        var title = input.Title?.Trim() ?? "";
        var description = input.Description?.Trim() ?? "";
        if (title.Length > 100 || description.Length > 2000)
            throw new WorkflowError(400, "input_too_long");
        var next = item with { Title = title, Description = description,
            Version = item.Version + 1 };
        await SaveAsync(session, item, next, actor, "edited", null, ct);
        return ToDetail(next, member);
    }

    public async Task<ApprovalDetail> SubmitAsync(
        Guid org, Guid actor, Guid id, VersionInput input, CancellationToken ct)
    {
        await using var session = await store.OpenAsync(org, actor, id, ct);
        var member = RequireMember(session);
        var item = RequireVisible(session, member);
        CheckVersion(item, input.ExpectedVersion);
        if (!ApprovalPolicy.GetActions(item, member).CanSubmit)
            throw new WorkflowError(403, "submit_not_allowed");
        if (string.IsNullOrWhiteSpace(item.Title) || string.IsNullOrWhiteSpace(item.Description))
            throw new WorkflowError(400, "submission_incomplete");
        var next = item with { Status = ApprovalStatus.Submitted, Version = item.Version + 1 };
        await SaveAsync(session, item, next, actor, "submitted", null, ct);
        return ToDetail(next, member);
    }

    private static async Task SaveAsync(
        IApprovalSession session, ApprovalRequest before, ApprovalRequest after,
        Guid actor, string action, string? reason, CancellationToken ct)
    {
        await session.SaveAsync(before, after, ct);
        await session.AppendHistoryAsync(new(after.Id, after.Version, actor, action,
            before.Status, after.Status, reason, DateTimeOffset.UtcNow), ct);
        await session.CommitAsync(ct);
    }
}

using System.Security.Claims;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[ApiController]
[Authorize]
[AutoValidateAntiforgeryToken]
[Route("api/organizations/{org:guid}/approvals")]
public sealed partial class ApprovalsController(ApprovalService service) : ControllerBase
{
    [HttpGet("{id:guid}")]
    public Task<IActionResult> Get(Guid org, Guid id, CancellationToken ct) =>
        Run(actor => service.GetAsync(org, actor, id, ct));

    [HttpPost]
    public Task<IActionResult> Create(Guid org, CancellationToken ct) =>
        Run(actor => service.CreateAsync(org, actor, ct));

    [HttpPut("{id:guid}")]
    public Task<IActionResult> Edit(Guid org, Guid id, EditApproval input, CancellationToken ct) =>
        Run(actor => service.EditAsync(org, actor, id, input, ct));

    [HttpPost("{id:guid}/submit")]
    public Task<IActionResult> Submit(Guid org, Guid id, VersionInput input, CancellationToken ct) =>
        Run(actor => service.SubmitAsync(org, actor, id, input, ct));

    private async Task<IActionResult> Run(Func<Guid, Task<ApprovalDetail>> action)
    {
        if (!Guid.TryParse(User.FindFirstValue(ClaimTypes.NameIdentifier), out var actor))
            return Unauthorized();
        Response.Headers.CacheControl = "no-store";
        try
        {
            return Ok(await action(actor));
        }
        catch (WorkflowError error)
        {
            var problem = new ProblemDetails
            {
                Status = error.Status,
                Title = "申請の操作を完了できませんでした。",
            };
            problem.Extensions["code"] = error.Code;
            return new ObjectResult(problem) { StatusCode = error.Status };
        }
    }
}

builder.Services.AddControllersWithViews();
builder.Services.AddAntiforgery(options =>
{
    options.HeaderName = "X-CSRF-TOKEN";
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
});
builder.Services.AddScoped<ApprovalService>();
// IApprovalStore の実装クラスも、ここで Scoped として登録する。

using Microsoft.AspNetCore.Antiforgery;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[ApiController]
[Authorize]
public sealed class CsrfController(IAntiforgery antiforgery) : ControllerBase
{
    [HttpGet("api/csrf")]
    public IActionResult Get()
    {
        Response.Headers.CacheControl = "no-store";
        return Ok(new { token = antiforgery.GetAndStoreTokens(HttpContext).RequestToken });
    }
}

{
  "title": "外付けモニターの購入",
  "description": "作業用の表示領域を増やすため、モニターの購入を申請します。",
  "expectedVersion": 1
}

{
  "expectedVersion": 2
}