1

Yes.Application/Admins/Themes/UpdateThemeCommandHandler.cs

@@ -9,15 +9,31 @@
         IOptionsMonitor<BlogSettings> options, 
         IMapper mapper, 
         IThemeService  themeService,
-		IConfigurationService configurationService
-	) : IRequestHandler<UpdateThemeCommand, Unit>
+		IConfigurationService configurationService,
+        BlogDbContext db,
+        IIdentityContext identity
+    ) : IRequestHandler<UpdateThemeCommand, Unit>
     {
         private readonly BlogSettings _settings = options.CurrentValue;
         private readonly IMapper _mapper = mapper;
         private readonly IThemeService _themeService = themeService;
         private readonly IConfigurationService _configurationService = configurationService;
+        private readonly BlogDbContext _db = db;
+        private readonly IIdentityContext _identity = identity;
         public async Task<Unit> Handle(UpdateThemeCommand request, CancellationToken cancellationToken)
         {
+            var identityUser = await _db.Users.FindAsync(_identity.Id);
+            if (identityUser == null)
+            {
+                throw new UserNotExistsException(_identity.Id);
+            }
+
+            if (!identityUser.IsSystemUser())
+            {
+                throw new AccessDeniedException();
+            }
+
+
             _themeService.CheckThemeExists(request.Theme);
 
             _mapper.Map(request, _settings);

Yes.Application/Admins/Themes/UpdateThemeFileCommandHandler.cs

@@ -9,13 +9,28 @@
 
     public class UpdateThemeFileCommandHandler(
         IThemeService  themeService, 
-        IWebHostEnvironment env
+        IWebHostEnvironment env,
+        BlogDbContext db,
+        IIdentityContext identity
     ) : IRequestHandler<UpdateThemeFileCommand, Unit>
     {
         private readonly IThemeService _themeService = themeService;
         private readonly IWebHostEnvironment _env = env;
+        private readonly BlogDbContext _db = db;
+        private readonly IIdentityContext _identity = identity;
         public async Task<Unit> Handle(UpdateThemeFileCommand request, CancellationToken cancellationToken)
         {
+            var identityUser = await _db.Users.FindAsync(_identity.Id);
+            if (identityUser == null)
+            {
+                throw new UserNotExistsException(_identity.Id);
+            }
+
+            if (!identityUser.IsSystemUser())
+            {
+                throw new AccessDeniedException();
+            }
+
             var themeName = request.ThemeName;
             var fileName = request.FileName;
             var content = request.Content;

Yes.Application/Admins/Themes/UploadThemeCommandHandler.cs

@@ -1,18 +1,32 @@
-
-
-namespace Yes.Application.Admins.Themes
+namespace Yes.Application.Admins.Themes
 {
     public record UploadThemeCommand(IFormFile File) : IRequest<UploadThemeCommandResponse>;
 
     public record UploadThemeCommandResponse(string DirName);
-    public class UploadThemeCommandHandler(IWebHostEnvironment env,
+    public class UploadThemeCommandHandler(
+        IWebHostEnvironment env,
+        BlogDbContext db,
+        IIdentityContext identity,
         IOptionsMonitor<BlogSettings> options) : IRequestHandler<UploadThemeCommand, UploadThemeCommandResponse>
     {
         private readonly IWebHostEnvironment _env = env;
         private readonly BlogSettings _settings = options.CurrentValue;
+        private readonly BlogDbContext _db = db;
+        private readonly IIdentityContext _identity = identity;
 
         public async Task<UploadThemeCommandResponse> Handle(UploadThemeCommand request, CancellationToken cancellationToken)
         {
+            var identityUser = await _db.Users.FindAsync(_identity.Id);
+            if (identityUser == null)
+            {
+                throw new UserNotExistsException(_identity.Id);
+            }
+
+            if (!identityUser.IsSystemUser())
+            {
+                throw new AccessDeniedException();
+            }
+
 
             try
             {