Interface IPermissionResolver

Namespace: Stratara.Abstractions.Authorization

Assembly: Stratara.Abstractions.dll

Resolves the effective permission set a user holds within a tenant — the lookup behind RequirePermissionAttribute enforcement (authorizing mediator, authorizing outbox dispatcher, HTTP permission policies).

public interface IPermissionResolver

Extension Methods: FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

The framework's default implementation maps the user's roles (tenant-scoped membership roles, optionally global identity roles) through the application's PermissionCatalog role grants. Custom implementations may resolve from a database grant store instead — the contract does not prescribe the source.

Implementations should be cheap to call repeatedly within one request scope (memoize per (userId, tenantId)); permission sets are deliberately not carried in the session context, cookies, or tokens.

Methods

ResolvePermissionsAsync(Guid, Guid, CancellationToken)

Resolves every permission the user effectively holds within the tenant.

ValueTask<IReadOnlySet<string>> ResolvePermissionsAsync(Guid userId, Guid tenantId, CancellationToken cancellationToken = default)

Parameters

userId Guid: The user whose permissions to resolve (typically the session's actor).
tenantId Guid: The tenant scope (typically the session's data-owner tenant).
cancellationToken CancellationToken: Token to observe while resolving.

Returns

ValueTask<IReadOnlySet<string>>: The effective permission set; empty when the user holds none.