Skip to main content
Table of Contents

Class RequireRoleAttribute

Namespace
Stratara.Abstractions.Authorization
Assembly
Stratara.Abstractions.dll

Marks a command or query type as requiring the caller to be in a specific role. The authorizing mediator decorator (AddAuthorizingMediator<T>()) checks the attribute on dispatch and throws AuthorizationException if the IAuthorizationProvider reports the role is missing.

[ExcludeFromCodeCoverage]
[AttributeUsage(AttributeTargets.Class, AllowMultiple = true)]
public sealed class RequireRoleAttribute : Attribute
Inheritance
RequireRoleAttribute
Inherited Members
Extension Methods

Examples

Annotate a sensitive admin command:

[RequireRole("PlatformAdmin")]
public sealed record SuspendTenant(Guid TenantId) : ICommand;

Register the authorizing decorator at host composition:

services.AddAuthorizingMediator<MyAuthorizationProvider>();

Remarks

Multiple attributes on the same target are ANDed — every listed role must be present. Apply only to request types (commands/queries), not handlers — the check runs before the handler is resolved. The AuthorizationStartupValidator hosted service fails fast at startup if any RequireRoleAttribute-decorated type is loaded but no IAuthorizationProvider is registered, so misconfigured hosts crash rather than silently dispatching unprotected.

Constructors

RequireRoleAttribute(string)

Marks a command or query type as requiring the caller to be in a specific role. The authorizing mediator decorator (AddAuthorizingMediator<T>()) checks the attribute on dispatch and throws AuthorizationException if the IAuthorizationProvider reports the role is missing.

public RequireRoleAttribute(string role)

Parameters

role string

The role name the caller must hold.

Examples

Annotate a sensitive admin command:

[RequireRole("PlatformAdmin")]
public sealed record SuspendTenant(Guid TenantId) : ICommand;

Register the authorizing decorator at host composition:

services.AddAuthorizingMediator<MyAuthorizationProvider>();

Remarks

Multiple attributes on the same target are ANDed — every listed role must be present. Apply only to request types (commands/queries), not handlers — the check runs before the handler is resolved. The AuthorizationStartupValidator hosted service fails fast at startup if any RequireRoleAttribute-decorated type is loaded but no IAuthorizationProvider is registered, so misconfigured hosts crash rather than silently dispatching unprotected.

Properties

Role

The role name the caller must hold.

public string Role { get; }

Property Value

string