Class PermissionAuthorizationHandler

Namespace

Stratara.Identity.AspNetCore.Authorization

Assembly

Stratara.Identity.AspNetCore.dll

Evaluates PermissionRequirement by resolving the caller's effective permission set through the registered IPermissionResolver — the user id comes from the principal's name-identifier claim, the tenant scope from the stratara:tenant_id claim (the one the membership sign-in bridge stamps).

public sealed class PermissionAuthorizationHandler : AuthorizationHandler<PermissionRequirement>, IAuthorizationHandler

Inheritance

object

AuthorizationHandler<PermissionRequirement>

PermissionAuthorizationHandler

Implements

IAuthorizationHandler

Inherited Members

AuthorizationHandler<PermissionRequirement>.HandleAsync(AuthorizationHandlerContext)

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Fail-closed: principals without a parseable user id or tenant claim never satisfy the requirement. The resolver is looked up per evaluation (the handler is registered scoped), so DB-backed resolution with per-scope memoization applies here exactly as in the mediator path — permissions are never read from claims.

Constructors

PermissionAuthorizationHandler(IPermissionResolver)

Evaluates PermissionRequirement by resolving the caller's effective permission set through the registered IPermissionResolver — the user id comes from the principal's name-identifier claim, the tenant scope from the stratara:tenant_id claim (the one the membership sign-in bridge stamps).

public PermissionAuthorizationHandler(IPermissionResolver permissionResolver)

Parameters

permissionResolver IPermissionResolver

The resolver supplying the caller's effective permissions.

Remarks

Fail-closed: principals without a parseable user id or tenant claim never satisfy the requirement. The resolver is looked up per evaluation (the handler is registered scoped), so DB-backed resolution with per-scope memoization applies here exactly as in the mediator path — permissions are never read from claims.

Methods

HandleRequirementAsync(AuthorizationHandlerContext, PermissionRequirement)

Makes a decision if authorization is allowed based on a specific requirement.

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement)

Parameters

context AuthorizationHandlerContext

The authorization context.

requirement PermissionRequirement

The requirement to evaluate.

Returns

Task