Class CatalogPermissionResolver

Namespace

Stratara.Identity.EntityFrameworkCore

Assembly

Stratara.Identity.EntityFrameworkCore.dll

Default IPermissionResolver: maps the user's active tenant-scoped membership roles through the application's PermissionCatalog role grants. Use the generic variant (CatalogPermissionResolver<TUser>) when global ASP.NET Identity roles (platform roles) should also grant permissions.

public sealed class CatalogPermissionResolver : IPermissionResolver

Inheritance

object

CatalogPermissionResolver

Implements

IPermissionResolver

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Register scoped; resolved sets are memoized per (userId, tenantId) within the scope, so repeated checks in one request incur one membership lookup. Fail-closed: no membership or a non-active membership yields an empty set.

Constructors

CatalogPermissionResolver(ITenantMembershipStore, PermissionCatalog)

Default IPermissionResolver: maps the user's active tenant-scoped membership roles through the application's PermissionCatalog role grants. Use the generic variant (CatalogPermissionResolver<TUser>) when global ASP.NET Identity roles (platform roles) should also grant permissions.

public CatalogPermissionResolver(ITenantMembershipStore membershipStore, PermissionCatalog catalog)

Parameters

membershipStore ITenantMembershipStore

The membership store the roles are read from.

catalog PermissionCatalog

The application's permission catalog (role grants).

Remarks

Register scoped; resolved sets are memoized per (userId, tenantId) within the scope, so repeated checks in one request incur one membership lookup. Fail-closed: no membership or a non-active membership yields an empty set.

Methods

ResolvePermissionsAsync(Guid, Guid, CancellationToken)

Resolves every permission the user effectively holds within the tenant.

public ValueTask<IReadOnlySet<string>> ResolvePermissionsAsync(Guid userId, Guid tenantId, CancellationToken cancellationToken = default)

Parameters

userId Guid

The user whose permissions to resolve (typically the session's actor).

tenantId Guid

The tenant scope (typically the session's data-owner tenant).

cancellationToken CancellationToken

Token to observe while resolving.

Returns

ValueTask<IReadOnlySet<string>>

The effective permission set; empty when the user holds none.