Interface IActorProvider

Namespace

Trellis.Authorization

Assembly

Trellis.Authorization.dll

Provides the current authenticated actor for authorization behaviors. Implement in the API/ACL layer, typically extracting from HttpContext.User or resolving permissions from a database. Register as scoped in DI.

public interface IActorProvider

Extension Methods

ActorProviderExtensions.RequireActorAsync(IActorProvider, CancellationToken)

MaybeExtensions.AsMaybe<T>(T)

AggregateTestMutator.ClearMaybeField<TEntity, TValue>(TEntity, Expression<Func<TEntity, Maybe<TValue>>>)

AggregateTestMutator.SetMaybeField<TEntity, TValue>(TEntity, Expression<Func<TEntity, Maybe<TValue>>>, TValue?)

Methods

GetCurrentActorAsync(CancellationToken)

Returns the current authenticated actor for the request, or None when the request has no usable authenticated actor.

Task<Maybe<Actor>> GetCurrentActorAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Token to cancel the asynchronous operation.

Returns

Task<Maybe<Actor>>

From<T>(T?) wrapping the resolved Actor when an authenticated identity is present and the framework can identify the actor.

None when the request has no usable authenticated actor — typically the request lacks credentials, the authentication middleware did not produce an authenticated identity, or the authenticated identity is missing the claim needed to identify the actor. The Trellis mediator authorization pipeline maps this to Error.AuthenticationRequired (HTTP 401) per RFC 9110 §15.5.2. "No authenticated actor" is client-error state, not an exception — model it via the return value, not by throwing.

Exceptions

InvalidOperationException

Thrown only for genuine infrastructure or configuration failures — for example, the provider was invoked outside an HTTP request scope (missing HttpContext), a user-supplied mapping delegate threw, or an option is misconfigured. The mediator pipeline does not catch this case; it surfaces as Error.Unexpected (HTTP 500), which is correct because these are bugs rather than authentication state. Do not throw for "missing actor" — return None instead.