Namespace Trellis.Authorization

Classes

Actor

Represents the current authenticated user making the request. Contains identity, permissions, forbidden permissions, and contextual attributes used by authorization behaviors.

ActorAttributes

Well-known attribute keys for Attributes used in attribute-based access control (ABAC) checks. Claim-based keys align with Azure Entra ID v2.0 access token claims. Use these constants instead of raw strings to prevent key-casing mismatches.

ActorId

Strongly-typed identifier for an authenticated principal (the value behind Id).

ActorProviderExtensions

Provides required actor access for callers with established actor presence and stable provider resolution.

ResourceLoaderById<TMessage, TResource, TId>

Convenience base class for resource loaders that extract a typed ID from the message and load via a repository's GetByIdAsync method.

SharedResourceLoaderById<TResource, TId>

Shared resource loader that loads a resource by ID. Register one per resource type instead of one ResourceLoaderById<TMessage, TResource, TId> per command.

Interfaces

IActorProvider

Provides the current authenticated actor for authorization behaviors. Implement in the API/ACL layer, typically extracting from HttpContext.User or resolving permissions from a database. Register as scoped in DI.

IAuthorizationMessage

Identifies a message that participates in the authorization dispatch pipeline.

IAuthorize

Marker interface for commands/queries that require static permissions. Authorization checks verify that the current actor has ALL of the RequiredPermissions before calling the handler.

IAuthorizeResourceVia<TOwner>

Declares resource-based authorization against a resource that is NOT the leaf resource the command identifies, but is reachable via one or more hops along IIdentifyRelatedResource<TRelated, TId> / IIdentifyRelatedResources<TRelated, TId> declarations on the entities along the path.

IAuthorizeResource<TResource>

Declares resource-based authorization that requires a loaded resource. Implemented by the command/query. The pipeline loads the resource via IResourceLoader<TMessage, TResource> and passes it to this method.

IAuthorizedResource<TMessage, TResource>

Scoped accessor for the resource the framework loaded and authorized for the current pipeline dispatch. Inject this into a handler to obtain the SAME instance the loader returned, eliminating a duplicate load when the handler would otherwise re-fetch the resource by id from its repository.

IIdentifyRelatedResource<TRelated, TId>

Declares that this resource has a single outbound navigation to a related resource of type TRelated identified by TId. Used by the pipeline to walk a chain of resources for indirect (multi-hop) resource authorization.

IIdentifyRelatedResources<TRelated, TId>

Declares that this resource has a plural outbound navigation to a set of related resources of type TRelated identified by TId. Used at the terminal hop of an indirect authorization chain to express OR-style / candidate-set authorization (e.g. cricket Match → {HomeTeam, AwayTeam}).

IIdentifyResource<TResource, TId>

Declares that this message carries a typed resource identifier that can be extracted for resource-based authorization. Implement alongside IAuthorizeResource<TResource> to use a SharedResourceLoaderById<TResource, TId> instead of a per-command ResourceLoaderById<TMessage, TResource, TId>.

IResourceAuthorizationMessage

Identifies a message whose dispatch requires successful resource authorization.

IResourceLoader<TMessage, TResource>

Loads the resource required for resource-based authorization. Registered in DI as scoped (typically depends on DbContext via a repository). Resolved per-request by the pipeline behavior via IServiceProvider.