Class CatalogPermissionResolver<TUser>

Namespace

Stratara.Identity.EntityFrameworkCore

Assembly

Stratara.Identity.EntityFrameworkCore.dll

Default IPermissionResolver spanning both role levels: the user's active tenant-scoped membership roles and their global ASP.NET Identity roles (platform roles) are mapped through the application's PermissionCatalog role grants — so a grant like GrantToRole("PlatformAdmin", ...) works regardless of which level the role lives on.

public sealed class CatalogPermissionResolver<TUser> : IPermissionResolver where TUser : class

Type Parameters

TUser

The host's ASP.NET Identity user entity.

Inheritance

object

CatalogPermissionResolver<TUser>

Implements

IPermissionResolver

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Register scoped; resolved sets are memoized per (userId, tenantId) within the scope. Fail-closed: unknown users and non-active memberships contribute no roles.

Constructors

CatalogPermissionResolver(ITenantMembershipStore, UserManager<TUser>, PermissionCatalog)

Default IPermissionResolver spanning both role levels: the user's active tenant-scoped membership roles and their global ASP.NET Identity roles (platform roles) are mapped through the application's PermissionCatalog role grants — so a grant like GrantToRole("PlatformAdmin", ...) works regardless of which level the role lives on.

public CatalogPermissionResolver(ITenantMembershipStore membershipStore, UserManager<TUser> userManager, PermissionCatalog catalog)

Parameters

membershipStore ITenantMembershipStore

The membership store the tenant-scoped roles are read from.

userManager UserManager<TUser>

The Identity user manager the global roles are read from.

catalog PermissionCatalog

The application's permission catalog (role grants).

Remarks

Register scoped; resolved sets are memoized per (userId, tenantId) within the scope. Fail-closed: unknown users and non-active memberships contribute no roles.

Methods

ResolvePermissionsAsync(Guid, Guid, CancellationToken)

Resolves every permission the user effectively holds within the tenant.

public ValueTask<IReadOnlySet<string>> ResolvePermissionsAsync(Guid userId, Guid tenantId, CancellationToken cancellationToken = default)

Parameters

userId Guid

The user whose permissions to resolve (typically the session's actor).

tenantId Guid

The tenant scope (typically the session's data-owner tenant).

cancellationToken CancellationToken

Token to observe while resolving.

Returns

ValueTask<IReadOnlySet<string>>

The effective permission set; empty when the user holds none.