Namespace Stratara.Identity.EntityFrameworkCore

ActiveTenantEntry: EF Core row shape for the active_tenant table — a user's explicit selection of which of their tenant memberships is the active one at sign-in (the tenant-switch persistence). At most one row per user.

ApiKeyEntry: EF Core row shape for the api_key table — one issued API key. Only the SHA-256 hash of the raw key is stored (lowercase hex, unique lookup index); the plaintext is shown once at issuance and unrecoverable afterwards.

CatalogPermissionResolver: Default IPermissionResolver: maps the user's active tenant-scoped membership roles through the application's PermissionCatalog role grants. Use the generic variant (CatalogPermissionResolver<TUser>) when global ASP.NET Identity roles (platform roles) should also grant permissions.

CatalogPermissionResolver<TUser>: Default IPermissionResolver spanning both role levels: the user's active tenant-scoped membership roles and their global ASP.NET Identity roles (platform roles) are mapped through the application's PermissionCatalog role grants — so a grant like GrantToRole("PlatformAdmin", ...) works regardless of which level the role lives on.

IdentityDirectoryDbContext<TContext>: Standalone EF Core context hosting the Stratara identity-directory tables (tenant_membership, active_tenant, setting_entry, api_key) for hosts that do not fold them into an existing context. Consumers derive a concrete context and own its migrations, mirroring the pattern of the ASP.NET Identity store base: class MyDirectoryDbContext(DbContextOptions<MyDirectoryDbContext> options) : IdentityDirectoryDbContext<MyDirectoryDbContext>(options).

IdentityDirectoryModelBuilderExtensions: Adds the Stratara identity-directory tables (tenant_membership, active_tenant, setting_entry, api_key) to an EF Core model. Call it from any DbContext's OnModelCreating — typically the consumer's existing ASP.NET Identity context, so the directory tables share that context's connection and migration lineage — or use IdentityDirectoryDbContext<TContext> for a standalone context.

MembershipAuthorizationProvider: Membership-backed IAuthorizationProvider: a role check passes when the current session's actor holds the role as a tenant-scoped membership role within the session's data-owner tenant. Use this overload for hosts without a global (ASP.NET Identity) role store; hosts that also gate on global platform roles use MembershipAuthorizationProvider<TUser> instead.

MembershipAuthorizationProvider<TUser>: Membership-backed IAuthorizationProvider spanning both role levels: a role check passes when the current session's actor holds the role either as a tenant-scoped membership role within the session's data-owner tenant or as a global ASP.NET Identity role (the platform-role level — platform-administrator, developer and similar roles that are not bound to any tenant).

MembershipCrossTenantAuthorizer: Membership-backed ICrossTenantAuthorizer for strict tenant isolation: a cross-tenant operation (actor tenant ≠ data-owner tenant) is allowed when the actor holds an active membership in the data-owner tenant, or when the actor holds one of the configured CrossTenantRoles (the operator-impersonation path for platform administrators, who typically hold no membership in the tenants they administer).

MembershipCrossTenantAuthorizerOptions: Options for MembershipCrossTenantAuthorizer.

SettingEntry: EF Core row shape for the setting_entry table — one setting value in one exact scope. The scope columns use the empty string (never NULL) for the unset dimension, so the composite primary key stays portable across providers with differing NULL-uniqueness rules.

TenantMembershipEntry: EF Core row shape for the tenant_membership table — one user's membership in one tenant with the tenant-scoped roles the user holds there. Persistence twin of the TenantMembership contract record.