From 500f87a22a4a4b4ed0be03b4f99965757f9c9a57 Mon Sep 17 00:00:00 2001
From: pshahsancsoft <pshah@sancsoft.com>
Date: Fri, 23 Aug 2024 11:52:26 -0400
Subject: [PATCH 1/3] Proto

---
 .../project-activity-list.component.html      |  10 +-
 .../project-details.service.ts                |  29 +++-
 .../project-roster-list.component.html        |  10 +-
 .../ProjectsAuthorizationHandler.cs           |  86 ++++++++++++
 .../ProjectsAuthorizationPolicies.cs          |  83 ++++++++++++
 .../Authorization/ProjectsOperation.cs        |  12 ++
 .../Controllers/ProjectsControllerV1.cs       | 127 +++++++++++++++---
 src/dotnet/HQ.Server/Program.cs               |   2 +-
 8 files changed, 336 insertions(+), 23 deletions(-)
 create mode 100644 src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationHandler.cs
 create mode 100644 src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationPolicies.cs
 create mode 100644 src/dotnet/HQ.Server/Authorization/ProjectsOperation.cs

diff --git a/src/angular/hq/src/app/projects/project-details/project-activity-list/project-activity-list.component.html b/src/angular/hq/src/app/projects/project-details/project-activity-list/project-activity-list.component.html
index 30a36d65..ae2992b1 100644
--- a/src/angular/hq/src/app/projects/project-details/project-activity-list/project-activity-list.component.html
+++ b/src/angular/hq/src/app/projects/project-details/project-activity-list/project-activity-list.component.html
@@ -13,7 +13,10 @@
       <tr>
         <td>{{ activity.name }}</td>
         <td class="text-right divide-x divide-teal-200">
-          @if ([HQRole.Executive, HQRole.Administrator] | inRole | async) {
+          @if (
+            ([HQRole.Executive, HQRole.Administrator] | inRole | async) ||
+            (projectDetailsService.canManageProjectStatusReport$ | async)
+          ) {
             <button
               type="button"
               class="text-teal-200 hover:text-teal-300 pr-3 uppercase"
@@ -34,7 +37,10 @@
     }
   </tbody>
 </table>
-@if ([HQRole.Executive, HQRole.Administrator] | inRole | async) {
+@if (
+  ([HQRole.Executive, HQRole.Administrator] | inRole | async) ||
+  (projectDetailsService.canManageProjectStatusReport$ | async)
+) {
   <form [formGroup]="form" (ngSubmit)="onSubmit()" class="p-5">
     <div class="border-b border-black pb-1 px-1 font-bold">Add Activity</div>
     <div class="mb-3 w-56">
diff --git a/src/angular/hq/src/app/projects/project-details/project-details.service.ts b/src/angular/hq/src/app/projects/project-details/project-details.service.ts
index 103cb6d4..ff5eb967 100644
--- a/src/angular/hq/src/app/projects/project-details/project-details.service.ts
+++ b/src/angular/hq/src/app/projects/project-details/project-details.service.ts
@@ -9,11 +9,14 @@ import {
   Subject,
   switchMap,
   tap,
+  combineLatest,
 } from 'rxjs';
 import { GetProjectRecordV1 } from '../../models/projects/get-project-v1';
 import { HQService } from '../../services/hq.service';
 import { GetClientRecordV1 } from '../../models/clients/get-client-v1';
 import { GetProjectActivityRecordV1 } from '../../models/projects/get-project-activity-v1';
+import { OidcSecurityService } from 'angular-auth-oidc-client';
+import { HQRole } from '../../enums/hqrole';
 
 @Injectable({
   providedIn: 'root',
@@ -25,12 +28,16 @@ export class ProjectDetailsService {
   client$: Observable<GetClientRecordV1>;
   project$: Observable<GetProjectRecordV1>;
   activities$: Observable<GetProjectActivityRecordV1[]>;
-
+  HQRole = HQRole;
   private projectIdSubject = new BehaviorSubject<string | null>(null);
   private psrIdSubject = new BehaviorSubject<string | null | undefined>(null);
   private refreshSubject = new Subject<void>();
+  canManageProjectStatusReport$: Observable<boolean>;
 
-  constructor(private hqService: HQService) {
+  constructor(
+    private hqService: HQService,
+    private oidcSecurityService: OidcSecurityService,
+  ) {
     const projectId$ = this.projectIdSubject.asObservable().pipe(
       filter((projectId) => projectId != null),
       map((projectId) => projectId!),
@@ -65,6 +72,23 @@ export class ProjectDetailsService {
       map((t) => t.records[0]),
       shareReplay({ bufferSize: 1, refCount: false }),
     );
+    this.canManageProjectStatusReport$ = combineLatest({
+      userData: oidcSecurityService.userData$.pipe(map((t) => t.userData)),
+      project: this.project$,
+    }).pipe(
+      map(
+        (t) =>
+          t.userData.roles &&
+          Array.isArray(t.userData.roles) &&
+          (t.userData.roles.includes(HQRole.Administrator) ||
+            t.userData.roles.includes(HQRole.Executive) ||
+            t.userData.roles.includes(HQRole.Partner) ||
+            (t.userData.roles.includes(HQRole.Manager) &&
+              t.project.projectManagerId == t.userData.staff_id)),
+      ),
+      map((t) => !!t),
+      shareReplay({ bufferSize: 1, refCount: false }),
+    );
   }
 
   setProjectId(projectId?: string | null) {
@@ -76,7 +100,6 @@ export class ProjectDetailsService {
   setPsrId(psrId?: string | null) {
     this.psrIdSubject.next(psrId);
   }
-
   refresh() {
     this.refreshSubject.next();
   }
diff --git a/src/angular/hq/src/app/projects/project-details/project-roster-list/project-roster-list.component.html b/src/angular/hq/src/app/projects/project-details/project-roster-list/project-roster-list.component.html
index 51985896..36a111bd 100644
--- a/src/angular/hq/src/app/projects/project-details/project-roster-list/project-roster-list.component.html
+++ b/src/angular/hq/src/app/projects/project-details/project-roster-list/project-roster-list.component.html
@@ -10,7 +10,10 @@
       <tr>
         <td>{{ staff.name }}</td>
         <td class="text-right divide-x divide-teal-200">
-          @if ([HQRole.Executive, HQRole.Administrator] | inRole | async) {
+          @if (
+            ([HQRole.Executive, HQRole.Administrator] | inRole | async) ||
+            (projectDetailsService.canManageProjectStatusReport$ | async)
+          ) {
             <button
               type="button"
               class="text-teal-200 hover:text-teal-300 pl-3 uppercase"
@@ -24,7 +27,10 @@
     }
   </tbody>
 </table>
-@if ([HQRole.Executive, HQRole.Administrator] | inRole | async) {
+@if (
+  ([HQRole.Executive, HQRole.Administrator] | inRole | async) ||
+  (projectDetailsService.canManageProjectStatusReport$ | async)
+) {
   <form [formGroup]="form" (ngSubmit)="onSubmit()" class="p-5">
     <div class="border-b border-black pb-1 px-1 font-bold">
       Add Staff Member
diff --git a/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationHandler.cs b/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationHandler.cs
new file mode 100644
index 00000000..99d09803
--- /dev/null
+++ b/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationHandler.cs
@@ -0,0 +1,86 @@
+using HQ.Server.Data;
+using HQ.Server.Data.Models;
+
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization.Infrastructure;
+using Microsoft.EntityFrameworkCore;
+
+namespace HQ.Server.Authorization;
+
+public class ProjectsAuthorizationHandler : AuthorizationHandler<OperationAuthorizationRequirement, Project>
+{
+    private readonly HQDbContext _context;
+
+    public ProjectsAuthorizationHandler(HQDbContext context)
+    {
+        _context = context;
+    }
+
+    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, OperationAuthorizationRequirement requirement, Project resource)
+    {
+        var staffId = context.User.GetStaffId();
+        var isStaff = context.User.IsInRole("staff");
+        var isExecutive = context.User.IsInRole("executive");
+        var isAdmin = context.User.IsInRole("administrator");
+
+        if (isExecutive || isAdmin)
+        {
+            context.Succeed(requirement);
+            return;
+        }
+
+        if (!isStaff)
+        {
+            return;
+        }
+
+        if (!staffId.HasValue)
+        {
+            return;
+        }
+
+        if (staffId.Value != resource.ProjectManagerId)
+        {
+            return;
+        }
+
+        var staff = await _context.Staff.FindAsync(staffId.Value);
+        if (staff == null)
+        {
+            return;
+        }
+        if (requirement.Name == nameof(ProjectsOperation.AddProjectMember))
+        {
+            context.Succeed(requirement);
+            return;
+        }
+        switch (requirement.Name)
+        {
+            case nameof(ProjectsOperation.AddProjectMember):
+                if (staffId.Value == resource.ProjectManagerId)
+                {
+                    context.Succeed(requirement);
+                }
+
+                break;
+            case nameof(ProjectsOperation.DeleteProjectActivity):
+                if (staffId.Value == resource.ProjectManagerId)
+                {
+                    context.Succeed(requirement);
+                }
+
+                break;
+            case nameof(ProjectsOperation.UpsertProjectActivity):
+                {
+                    context.Succeed(requirement);
+                }
+                break;
+            case nameof(ProjectsOperation.RemoveProjectMember):
+                {
+                    context.Succeed(requirement);
+                }
+                break;
+        }
+
+    }
+}
\ No newline at end of file
diff --git a/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationPolicies.cs b/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationPolicies.cs
new file mode 100644
index 00000000..debe402a
--- /dev/null
+++ b/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationPolicies.cs
@@ -0,0 +1,83 @@
+using HQ.Server.Data;
+using HQ.Server.Data.Models;
+
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization.Infrastructure;
+using Microsoft.EntityFrameworkCore;
+
+namespace HQ.Server.Authorization;
+
+public class ProjectsAuthorizationHandler : AuthorizationHandler<OperationAuthorizationRequirement, Project>
+{
+    private readonly HQDbContext _context;
+
+    public ProjectsAuthorizationHandler(HQDbContext context)
+    {
+        _context = context;
+    }
+
+    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, OperationAuthorizationRequirement requirement, Project resource)
+    {
+        var staffId = context.User.GetStaffId();
+        var isStaff = context.User.IsInRole("staff");
+        var isExecutive = context.User.IsInRole("executive");
+        var isAdmin = context.User.IsInRole("administrator");
+
+        if (isExecutive || isAdmin)
+        {
+            context.Succeed(requirement);
+            return;
+        }
+
+        if (!isStaff)
+        {
+            return;
+        }
+
+        if (!staffId.HasValue)
+        {
+            return;
+        }
+
+        if (staffId.Value != resource.ProjectManagerId)
+        {
+            return;
+        }
+
+        var staff = await _context.Staff.FindAsync(staffId.Value);
+        if (staff == null)
+        {
+            return;
+        }
+        if (requirement.Name == nameof(ProjectsOperation.AddProjectMember))
+        {
+            // For debugging, directly succeed the requirement
+            context.Succeed(requirement);
+            return;
+        }
+        switch (requirement.Name)
+        {
+            case nameof(ProjectsOperation.AddProjectMember):
+                if (staffId.Value == resource.ProjectManagerId)
+                {
+                    context.Succeed(requirement);
+                }
+
+                break;
+            case nameof(ProjectsOperation.DeleteProjectActivity):
+                if (staffId.Value == resource.ProjectManagerId)
+                {
+                    context.Succeed(requirement);
+                }
+
+                break;
+            case nameof(ProjectsOperation.UpsertProjectActivity):
+            case nameof(ProjectsOperation.RemoveProjectMember):
+                {
+                    context.Succeed(requirement);
+                }
+                break;
+        }
+
+    }
+}
\ No newline at end of file
diff --git a/src/dotnet/HQ.Server/Authorization/ProjectsOperation.cs b/src/dotnet/HQ.Server/Authorization/ProjectsOperation.cs
new file mode 100644
index 00000000..7b771bbb
--- /dev/null
+++ b/src/dotnet/HQ.Server/Authorization/ProjectsOperation.cs
@@ -0,0 +1,12 @@
+using Microsoft.AspNetCore.Authorization.Infrastructure;
+
+namespace HQ.Server.Authorization;
+
+public class ProjectsOperation
+{
+    public static OperationAuthorizationRequirement RemoveProjectMember = new OperationAuthorizationRequirement { Name = nameof(RemoveProjectMember) };
+    public static OperationAuthorizationRequirement AddProjectMember = new OperationAuthorizationRequirement { Name = nameof(AddProjectMember) };
+    public static OperationAuthorizationRequirement DeleteProjectActivity = new OperationAuthorizationRequirement { Name = nameof(DeleteProjectActivity) };
+    public static OperationAuthorizationRequirement UpsertProjectActivity = new OperationAuthorizationRequirement { Name = nameof(UpsertProjectActivity) };
+
+}
\ No newline at end of file
diff --git a/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs b/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs
index 7427a863..07fba960 100644
--- a/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs
+++ b/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs
@@ -10,6 +10,9 @@
 
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using HQ.Server.Data;
+using Microsoft.EntityFrameworkCore;
+using HQ.Server.Data.Models;
 
 namespace HQ.Server.Controllers
 {
@@ -22,10 +25,15 @@ namespace HQ.Server.Controllers
     public class ProjectsControllerV1 : ControllerBase
     {
         private readonly ProjectServiceV1 _projectService;
+        private readonly HQDbContext _context;
+        private readonly IAuthorizationService _authorizationService;
 
-        public ProjectsControllerV1(ProjectServiceV1 projectService)
+        public ProjectsControllerV1(ProjectServiceV1 projectService, HQDbContext context, IAuthorizationService authorizationService)
         {
             _projectService = projectService;
+            _context = context;
+            _authorizationService = authorizationService;
+
         }
 
         [Authorize(HQAuthorizationPolicies.Staff)]
@@ -51,15 +59,38 @@ public Task<ActionResult> UpsertProjectV1([FromBody] UpsertProjectV1.Request req
 
         [Authorize(HQAuthorizationPolicies.Manager)]
         [HttpPost(nameof(UpsertProjectActivityV1))]
-        [ProducesResponseType<UpsertProjectActivityV1.Response>(StatusCodes.Status201Created)]
-        public Task<ActionResult> UpsertProjectActivityV1([FromBody] UpsertProjectActivityV1.Request request, CancellationToken ct = default) =>
-            _projectService.UpsertProjectActivityV1(request, ct)
+        [ProducesResponseType<AddProjectMemberV1.Response>(StatusCodes.Status200OK)]
+        [ProducesResponseType(StatusCodes.Status404NotFound)]
+        [ProducesResponseType(StatusCodes.Status403Forbidden)]
+        public async Task<ActionResult> UpsertProjectActivityV1([FromBody] UpsertProjectActivityV1.Request request, CancellationToken ct = default)
+        {
+
+            var project = await _context.Projects
+                .AsNoTracking()
+                .SingleOrDefaultAsync(t => t.Id == request.Id);
+
+            if (project == null)
+            {
+                return NotFound();
+            }
+
+            var authorizationResult = await _authorizationService
+                .AuthorizeAsync(User, project, ProjectsOperation.UpsertProjectActivity);
+
+            if (!authorizationResult.Succeeded)
+            {
+                return Forbid();
+            }
+
+            return await _projectService.UpsertProjectActivityV1(request, ct)
             .ToActionResult(new HQResultEndpointProfile());
 
+        }
+
         [Authorize(HQAuthorizationPolicies.Manager)]
         [HttpPost(nameof(DeleteProjectV1))]
-        [ProducesResponseType(StatusCodes.Status204NoContent)]
         [ProducesResponseType(StatusCodes.Status404NotFound)]
+        [ProducesResponseType(StatusCodes.Status403Forbidden)]
         public Task<ActionResult> DeleteProjectV1([FromBody] DeleteProjectV1.Request request, CancellationToken ct = default) =>
             _projectService.DeleteProjectV1(request, ct)
             .ToActionResult(new HQResultEndpointProfile());
@@ -67,27 +98,93 @@ public Task<ActionResult> DeleteProjectV1([FromBody] DeleteProjectV1.Request req
 
         [Authorize(HQAuthorizationPolicies.Manager)]
         [HttpPost(nameof(DeleteProjectActivityV1))]
-        [ProducesResponseType(StatusCodes.Status204NoContent)]
+        [ProducesResponseType<DeleteProjectActivityV1.Response>(StatusCodes.Status200OK)]
         [ProducesResponseType(StatusCodes.Status404NotFound)]
-        public Task<ActionResult> DeleteProjectActivityV1([FromBody] DeleteProjectActivityV1.Request request, CancellationToken ct = default) =>
-            _projectService.DeleteProjectActivityV1(request, ct)
+        [ProducesResponseType(StatusCodes.Status403Forbidden)]
+        public async Task<ActionResult> DeleteProjectActivityV1([FromBody] DeleteProjectActivityV1.Request request, CancellationToken ct = default)
+        {
+
+            var project = await _context.Projects
+                .AsNoTracking()
+                .SingleOrDefaultAsync(t => t.Id == request.Id);
+
+            if (project == null)
+            {
+                return NotFound();
+            }
+
+            var authorizationResult = await _authorizationService
+                .AuthorizeAsync(User, project, ProjectsOperation.DeleteProjectActivity);
+
+            if (!authorizationResult.Succeeded)
+            {
+                return Forbid();
+            }
+
+            return await _projectService.DeleteProjectActivityV1(request, ct)
             .ToActionResult(new HQResultEndpointProfile());
 
-        [Authorize(HQAuthorizationPolicies.Manager)]
+        }
+        [Authorize(HQAuthorizationPolicies.Staff)]
         [HttpPost(nameof(AddProjectMemberV1))]
-        [ProducesResponseType(StatusCodes.Status204NoContent)]
+        [ProducesResponseType<AddProjectMemberV1.Response>(StatusCodes.Status201Created)]
         [ProducesResponseType(StatusCodes.Status404NotFound)]
-        public Task<ActionResult> AddProjectMemberV1([FromBody] AddProjectMemberV1.Request request, CancellationToken ct = default) =>
-            _projectService.AddProjectMemberV1(request, ct)
+        [ProducesResponseType(StatusCodes.Status403Forbidden)]
+
+        public async Task<ActionResult> AddProjectMemberV1([FromBody] AddProjectMemberV1.Request request, CancellationToken ct = default)
+        {
+
+            var project = await _context.Projects
+                .AsNoTracking()
+                .SingleOrDefaultAsync(t => t.Id == request.ProjectId);
+
+            if (project == null)
+            {
+                return NotFound();
+            }
+
+            var authorizationResult = await _authorizationService
+                .AuthorizeAsync(User, project, ProjectsOperation.AddProjectMember);
+
+            if (!authorizationResult.Succeeded)
+            {
+                return Forbid();
+            }
+
+            return await _projectService.AddProjectMemberV1(request, ct)
             .ToActionResult(new HQResultEndpointProfile());
 
+        }
+
+
+
         [Authorize(HQAuthorizationPolicies.Manager)]
         [HttpPost(nameof(RemoveProjectMemberV1))]
-        [ProducesResponseType(StatusCodes.Status204NoContent)]
+        [ProducesResponseType<RemoveProjectMemberV1.Response>(StatusCodes.Status200OK)]
         [ProducesResponseType(StatusCodes.Status404NotFound)]
-        public Task<ActionResult> RemoveProjectMemberV1([FromBody] RemoveProjectMemberV1.Request request, CancellationToken ct = default) =>
-            _projectService.RemoveProjectMemberV1(request, ct)
+        [ProducesResponseType(StatusCodes.Status403Forbidden)]
+        public async Task<ActionResult> RemoveProjectMemberV1([FromBody] RemoveProjectMemberV1.Request request, CancellationToken ct = default)
+        {
+            var project = await _context.Projects
+               .AsNoTracking()
+               .SingleOrDefaultAsync(t => t.Id == request.ProjectId);
+
+            if (project == null)
+            {
+                return NotFound();
+            }
+
+            var authorizationResult = await _authorizationService
+                .AuthorizeAsync(User, project, ProjectsOperation.RemoveProjectMember);
+
+            if (!authorizationResult.Succeeded)
+            {
+                return Forbid();
+            }
+
+            return await _projectService.RemoveProjectMemberV1(request, ct)
             .ToActionResult(new HQResultEndpointProfile());
+        }
 
         [Authorize(HQAuthorizationPolicies.Administrator)]
         [HttpPost(nameof(ImportProjectsV1))]
diff --git a/src/dotnet/HQ.Server/Program.cs b/src/dotnet/HQ.Server/Program.cs
index 3880715e..0cc34bd7 100644
--- a/src/dotnet/HQ.Server/Program.cs
+++ b/src/dotnet/HQ.Server/Program.cs
@@ -87,7 +87,7 @@
 
 builder.Services.AddScoped<IAuthorizationHandler, ProjectStatusReportAuthorizationHandler>();
 builder.Services.AddScoped<IAuthorizationHandler, PointsAuthorizationHandler>();
-
+builder.Services.AddScoped<IAuthorizationHandler, ProjectsAuthorizationHandler>();
 builder.Services.AddScoped<IAuthorizationHandler, TimeEntryAuthorizationHandler>();
 builder.Services.AddScoped<IAuthorizationHandler, PlanAuthorizationHandler>();
 

From e561d34dbe6cdc852cb6526df80ca37145cf7e2b Mon Sep 17 00:00:00 2001
From: pshahsancsoft <pshah@sancsoft.com>
Date: Fri, 23 Aug 2024 14:16:05 -0400
Subject: [PATCH 2/3] PM can edit activities and roster

---
 .../projects/delete-project-activity-v1.ts    |  1 +
 .../project-activity-list.component.ts        |  8 +-
 .../Projects/DeleteProjectActivityV1.cs       |  1 +
 .../ProjectsAuthorizationHandler.cs           |  4 +
 .../ProjectsAuthorizationPolicies.cs          | 83 -------------------
 .../Controllers/ProjectsControllerV1.cs       | 12 ++-
 .../HQ.Server/Services/ProjectServiceV1.cs    |  2 +-
 7 files changed, 19 insertions(+), 92 deletions(-)
 delete mode 100644 src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationPolicies.cs

diff --git a/src/angular/hq/src/app/models/projects/delete-project-activity-v1.ts b/src/angular/hq/src/app/models/projects/delete-project-activity-v1.ts
index 1c3c15d8..6e993768 100644
--- a/src/angular/hq/src/app/models/projects/delete-project-activity-v1.ts
+++ b/src/angular/hq/src/app/models/projects/delete-project-activity-v1.ts
@@ -1,4 +1,5 @@
 export interface DeleteProjectActivityV1Request {
+  projectId: string;
   id: string;
 }
 
diff --git a/src/angular/hq/src/app/projects/project-details/project-activity-list/project-activity-list.component.ts b/src/angular/hq/src/app/projects/project-details/project-activity-list/project-activity-list.component.ts
index 299e68b4..6dcabf9a 100644
--- a/src/angular/hq/src/app/projects/project-details/project-activity-list/project-activity-list.component.ts
+++ b/src/angular/hq/src/app/projects/project-details/project-activity-list/project-activity-list.component.ts
@@ -87,6 +87,9 @@ export class ProjectActivityListComponent {
   }
 
   async deleteActivity(activityId: string) {
+    const projectId = await firstValueFrom(
+      this.projectDetailsService.projectId$,
+    );
     const confirmation = await firstValueFrom(
       this.modalService.confirm(
         'Confirmation',
@@ -96,7 +99,10 @@ export class ProjectActivityListComponent {
     if (confirmation) {
       try {
         await firstValueFrom(
-          this.hqService.deleteProjectActivityV1({ id: activityId }),
+          this.hqService.deleteProjectActivityV1({
+            projectId,
+            id: activityId,
+          }),
         );
         this.projectDetailsService.refresh();
         this.toastService.show('Success', 'Activity successfully deleted');
diff --git a/src/dotnet/HQ.Abstractions/Projects/DeleteProjectActivityV1.cs b/src/dotnet/HQ.Abstractions/Projects/DeleteProjectActivityV1.cs
index 3c75ad96..53ed20e4 100644
--- a/src/dotnet/HQ.Abstractions/Projects/DeleteProjectActivityV1.cs
+++ b/src/dotnet/HQ.Abstractions/Projects/DeleteProjectActivityV1.cs
@@ -12,6 +12,7 @@ public class DeleteProjectActivityV1
 {
     public class Request
     {
+        public Guid ProjectId { get; set; }
         public Guid Id { get; set; }
     }
 
diff --git a/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationHandler.cs b/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationHandler.cs
index 99d09803..28867bad 100644
--- a/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationHandler.cs
+++ b/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationHandler.cs
@@ -71,14 +71,18 @@ protected override async Task HandleRequirementAsync(AuthorizationHandlerContext
 
                 break;
             case nameof(ProjectsOperation.UpsertProjectActivity):
+                if (staffId.Value == resource.ProjectManagerId)
                 {
                     context.Succeed(requirement);
                 }
+
                 break;
             case nameof(ProjectsOperation.RemoveProjectMember):
+                if (staffId.Value == resource.ProjectManagerId)
                 {
                     context.Succeed(requirement);
                 }
+
                 break;
         }
 
diff --git a/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationPolicies.cs b/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationPolicies.cs
deleted file mode 100644
index debe402a..00000000
--- a/src/dotnet/HQ.Server/Authorization/ProjectsAuthorizationPolicies.cs
+++ /dev/null
@@ -1,83 +0,0 @@
-using HQ.Server.Data;
-using HQ.Server.Data.Models;
-
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Authorization.Infrastructure;
-using Microsoft.EntityFrameworkCore;
-
-namespace HQ.Server.Authorization;
-
-public class ProjectsAuthorizationHandler : AuthorizationHandler<OperationAuthorizationRequirement, Project>
-{
-    private readonly HQDbContext _context;
-
-    public ProjectsAuthorizationHandler(HQDbContext context)
-    {
-        _context = context;
-    }
-
-    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, OperationAuthorizationRequirement requirement, Project resource)
-    {
-        var staffId = context.User.GetStaffId();
-        var isStaff = context.User.IsInRole("staff");
-        var isExecutive = context.User.IsInRole("executive");
-        var isAdmin = context.User.IsInRole("administrator");
-
-        if (isExecutive || isAdmin)
-        {
-            context.Succeed(requirement);
-            return;
-        }
-
-        if (!isStaff)
-        {
-            return;
-        }
-
-        if (!staffId.HasValue)
-        {
-            return;
-        }
-
-        if (staffId.Value != resource.ProjectManagerId)
-        {
-            return;
-        }
-
-        var staff = await _context.Staff.FindAsync(staffId.Value);
-        if (staff == null)
-        {
-            return;
-        }
-        if (requirement.Name == nameof(ProjectsOperation.AddProjectMember))
-        {
-            // For debugging, directly succeed the requirement
-            context.Succeed(requirement);
-            return;
-        }
-        switch (requirement.Name)
-        {
-            case nameof(ProjectsOperation.AddProjectMember):
-                if (staffId.Value == resource.ProjectManagerId)
-                {
-                    context.Succeed(requirement);
-                }
-
-                break;
-            case nameof(ProjectsOperation.DeleteProjectActivity):
-                if (staffId.Value == resource.ProjectManagerId)
-                {
-                    context.Succeed(requirement);
-                }
-
-                break;
-            case nameof(ProjectsOperation.UpsertProjectActivity):
-            case nameof(ProjectsOperation.RemoveProjectMember):
-                {
-                    context.Succeed(requirement);
-                }
-                break;
-        }
-
-    }
-}
\ No newline at end of file
diff --git a/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs b/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs
index 07fba960..036f1890 100644
--- a/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs
+++ b/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs
@@ -59,7 +59,7 @@ public Task<ActionResult> UpsertProjectV1([FromBody] UpsertProjectV1.Request req
 
         [Authorize(HQAuthorizationPolicies.Manager)]
         [HttpPost(nameof(UpsertProjectActivityV1))]
-        [ProducesResponseType<AddProjectMemberV1.Response>(StatusCodes.Status200OK)]
+        [ProducesResponseType<AddProjectMemberV1.Response>(StatusCodes.Status201Created)]
         [ProducesResponseType(StatusCodes.Status404NotFound)]
         [ProducesResponseType(StatusCodes.Status403Forbidden)]
         public async Task<ActionResult> UpsertProjectActivityV1([FromBody] UpsertProjectActivityV1.Request request, CancellationToken ct = default)
@@ -67,7 +67,7 @@ public async Task<ActionResult> UpsertProjectActivityV1([FromBody] UpsertProject
 
             var project = await _context.Projects
                 .AsNoTracking()
-                .SingleOrDefaultAsync(t => t.Id == request.Id);
+                .SingleOrDefaultAsync(t => t.Id == request.ProjectId);
 
             if (project == null)
             {
@@ -98,15 +98,14 @@ public Task<ActionResult> DeleteProjectV1([FromBody] DeleteProjectV1.Request req
 
         [Authorize(HQAuthorizationPolicies.Manager)]
         [HttpPost(nameof(DeleteProjectActivityV1))]
-        [ProducesResponseType<DeleteProjectActivityV1.Response>(StatusCodes.Status200OK)]
         [ProducesResponseType(StatusCodes.Status404NotFound)]
         [ProducesResponseType(StatusCodes.Status403Forbidden)]
         public async Task<ActionResult> DeleteProjectActivityV1([FromBody] DeleteProjectActivityV1.Request request, CancellationToken ct = default)
         {
 
             var project = await _context.Projects
-                .AsNoTracking()
-                .SingleOrDefaultAsync(t => t.Id == request.Id);
+               .AsNoTracking()
+               .SingleOrDefaultAsync(t => t.Id == request.ProjectId);
 
             if (project == null)
             {
@@ -125,7 +124,7 @@ public async Task<ActionResult> DeleteProjectActivityV1([FromBody] DeleteProject
             .ToActionResult(new HQResultEndpointProfile());
 
         }
-        [Authorize(HQAuthorizationPolicies.Staff)]
+        [Authorize(HQAuthorizationPolicies.Manager)]
         [HttpPost(nameof(AddProjectMemberV1))]
         [ProducesResponseType<AddProjectMemberV1.Response>(StatusCodes.Status201Created)]
         [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -160,7 +159,6 @@ public async Task<ActionResult> AddProjectMemberV1([FromBody] AddProjectMemberV1
 
         [Authorize(HQAuthorizationPolicies.Manager)]
         [HttpPost(nameof(RemoveProjectMemberV1))]
-        [ProducesResponseType<RemoveProjectMemberV1.Response>(StatusCodes.Status200OK)]
         [ProducesResponseType(StatusCodes.Status404NotFound)]
         [ProducesResponseType(StatusCodes.Status403Forbidden)]
         public async Task<ActionResult> RemoveProjectMemberV1([FromBody] RemoveProjectMemberV1.Request request, CancellationToken ct = default)
diff --git a/src/dotnet/HQ.Server/Services/ProjectServiceV1.cs b/src/dotnet/HQ.Server/Services/ProjectServiceV1.cs
index b08515f7..e5e25179 100644
--- a/src/dotnet/HQ.Server/Services/ProjectServiceV1.cs
+++ b/src/dotnet/HQ.Server/Services/ProjectServiceV1.cs
@@ -451,7 +451,7 @@ public ProjectServiceV1(ChargeCodeServiceV1 chargeCodeServiceV1, HQDbContext con
         {
             return Result.Fail("Activity has time associated with it, unable to delete");
         }
-        var projectActivity = await _context.ProjectActivities.FindAsync(request.Id, ct);
+        var projectActivity = await _context.ProjectActivities.SingleOrDefaultAsync(t => t.ProjectId == request.ProjectId && t.Id == request.Id, ct);
         if (projectActivity != null)
         {
             _context.ProjectActivities.Remove(projectActivity);

From e4157e480addab60bac06abd50ddacbbf035bcdb Mon Sep 17 00:00:00 2001
From: pshahsancsoft <pshah@sancsoft.com>
Date: Wed, 28 Aug 2024 16:03:10 -0400
Subject: [PATCH 3/3] Dotnet Format

---
 src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs b/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs
index 036f1890..2f9a94b6 100644
--- a/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs
+++ b/src/dotnet/HQ.Server/Controllers/ProjectsControllerV1.cs
@@ -6,13 +6,13 @@
 using HQ.Abstractions.Projects;
 using HQ.API;
 using HQ.Server.Authorization;
+using HQ.Server.Data;
+using HQ.Server.Data.Models;
 using HQ.Server.Services;
 
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
-using HQ.Server.Data;
 using Microsoft.EntityFrameworkCore;
-using HQ.Server.Data.Models;
 
 namespace HQ.Server.Controllers
 {