Namespace Stratara.Abstractions.Authorization
Classes
- AuthorizationException
Thrown by the authorizing mediator/dispatcher decorators when the caller does not hold a role required by RequireRoleAttribute on the dispatched request type. Permission failures (RequirePermissionAttribute) throw the derived PermissionAuthorizationException, so a single catch of this base type maps every authorization denial (typically to HTTP 403).
- PermissionAuthorizationException
Thrown by the authorizing mediator/dispatcher decorators when the caller does not hold a permission required by RequirePermissionAttribute on the dispatched request type. Derives from AuthorizationException so existing role-era handlers (403 mapping) catch permission denials without change.
- PermissionCatalog
The application's permission vocabulary plus its role→permission grants, declared in code at startup and registered as a singleton. The catalog is the single source of what permission names exist; role grants map coarse roles (tenant-scoped membership roles or global platform roles alike) onto sets of fine-grained permissions.
- RequirePermissionAttribute
Declares that dispatching the decorated command/query requires the caller to hold the named permission — the fine-grained sibling of RequireRoleAttribute. Enforced by the authorizing mediator and the authorizing outbox dispatcher before the handler runs; multiple attributes on the same request are ANDed (every permission must be held).
- RequireRoleAttribute
Marks a command or query type as requiring the caller to be in a specific role. The authorizing mediator decorator (
AddAuthorizingMediator<T>()) checks the attribute on dispatch and throws AuthorizationException if the IAuthorizationProvider reports the role is missing.
Interfaces
- IAuthorizationProvider
Provides role-membership checks for the authorizing mediator + command-outbox-dispatcher decorators. Implementations typically read from
HttpContext.User, a JWT claim set, or a tenant-scoped identity service.
- IPermissionResolver
Resolves the effective permission set a user holds within a tenant — the lookup behind RequirePermissionAttribute enforcement (authorizing mediator, authorizing outbox dispatcher, HTTP permission policies).