Class ResourceAuthorizationOptions

Namespace

Trellis.Mediator

Assembly

Trellis.Mediator.dll

Configures the resource-authorization pipeline's failure-exposure policy on a per-resource basis. Register via services.AddResourceAuthorization(o => o.HideExistence<Incident>()) or through the TrellisServiceBuilder.UseResourceAuthorization(o => ...) composition slot.

public sealed class ResourceAuthorizationOptions

Inheritance

object

ResourceAuthorizationOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

MaybeExtensions.AsMaybe<T>(T)

AggregateTestMutator.ClearMaybeField<TEntity, TValue>(TEntity, Expression<Func<TEntity, Maybe<TValue>>>)

AggregateTestMutator.SetMaybeField<TEntity, TValue>(TEntity, Expression<Func<TEntity, Maybe<TValue>>>, TValue?)

Remarks

The default policy is Propagate — every command returns the original Error.Forbidden / Error.AuthenticationRequired until the consumer opts a resource into HideAsNotFound. There is no global "hide everything" switch by design: hiding existence is a per-resource security decision and a blanket default would silently change the wire shape of every authorization failure.

Translation scope. The pipeline normalizes root Error.NotFound, Error.Gone, Error.Forbidden, and Error.AuthenticationRequired to the same public NotFound. Its type and identifier come from the configured public resource and message, and its code/detail come only from this configuration. Original metadata and causes are not copied to the public error. Other direct-resource and via-leaf errors pass through unchanged. Via intermediate/owner load failures retain their collapse-to-denial behavior.

Pipeline interaction. When a command implements both IAuthorize and IAuthorizeResource<T>, the static-permission AuthorizationBehavior runs BEFORE the resource-authorization behavior. An unauthenticated caller whose request fails the static gate sees the original 401/403 — the hide-as-NotFound translation never runs. Commands that need existence-hiding to apply to every failure mode should omit IAuthorize and let HideAsNotFound cover the resource-authorization branch alone.

Cache safety. Hidden 404s can be shared across actors regardless of body differences. Protect them with Cache-Control: no-store or private — a shared cache will otherwise serve an unauthorized actor's synthetic 404 to a later authorized actor.

Normalization applies to the resource-authorization stage, not unrelated handler errors or application response customization. It does not equalize response timing.

Properties

DefaultExposurePolicy

Gets or sets the default exposure policy applied to resources that have no per-resource override. Defaults to Propagate.

public AuthFailureExposurePolicy DefaultExposurePolicy { get; set; }

Property Value

AuthFailureExposurePolicy

Methods

HideExistence<TResource>()

Opt the given resource into HideAsNotFound. Missing resources and authorization denials receive the same public NotFound using TResource as both the public type and ID extraction source. The default code and detail are used.

public ResourceAuthorizationOptions HideExistence<TResource>() where TResource : class

Returns

ResourceAuthorizationOptions

This options instance for chaining.

Type Parameters

TResource

The resource type to hide. Must be a reference type because the resource-authorization behaviors already constrain where TResource : class.

HideExistence<TResource>(string?, string?)

Hides existence using fixed public metadata shared by missing and withheld resources.

public ResourceAuthorizationOptions HideExistence<TResource>(string? code = null, string? detail = null) where TResource : class

Parameters

code string

The public reason code. Null, empty, or whitespace uses the default unspecified code.

detail string

The public detail, or null to use the standard NotFound rendering.

Returns

ResourceAuthorizationOptions

This options instance for chaining.

Type Parameters

TResource

The reference-type resource to hide.

Remarks

Replaces this resource's previous configuration. Parameterless reconfiguration resets code/detail.

HideExistence<TAuthorizationResource, TPublicResource>()

Opt the given resource into HideAsNotFound using a separate public resource type for the canonical NotFound payload. Use this when the loader projects to an internal authorization shape that is not the canonical wire-public type (for example loading OrderOwnership for the authorization check while exposing Order as the public resource).

public ResourceAuthorizationOptions HideExistence<TAuthorizationResource, TPublicResource>() where TAuthorizationResource : class

Returns

ResourceAuthorizationOptions

This options instance for chaining.

Type Parameters

TAuthorizationResource

The resource type the loader returns (what the pipeline authorizes against).

TPublicResource

The resource type to publish in the synthetic NotFound's ResourceRef. The pipeline also uses this type to locate an IIdentifyResource<TPublicResource, TId> implementation on the message for ID extraction, falling back to IIdentifyResource<TAuthorizationResource, TId> if the public variant is not present.

HideExistence<TAuthorizationResource, TPublicResource>(string?, string?)

Hides a projected authorization resource using a public resource type and fixed public metadata. Missing and withheld resources receive the same public NotFound.

public ResourceAuthorizationOptions HideExistence<TAuthorizationResource, TPublicResource>(string? code = null, string? detail = null) where TAuthorizationResource : class

Parameters

code string

The public reason code. Null, empty, or whitespace uses the default unspecified code.

detail string

The public detail, or null to use the standard NotFound rendering.

Returns

ResourceAuthorizationOptions

This options instance for chaining.

Type Parameters

TAuthorizationResource

The reference-type resource returned by the loader.

TPublicResource

The public resource type used for the NotFound and identifier lookup.

Remarks

Replaces this resource's previous configuration. Parameterless reconfiguration resets code/detail.

Propagate<TResource>()

Explicitly opt the given resource into Propagate. Useful for overriding a non-Propagate DefaultExposurePolicy on individual resources.

public ResourceAuthorizationOptions Propagate<TResource>() where TResource : class

Returns

ResourceAuthorizationOptions

This options instance for chaining.

Type Parameters

TResource

The resource type whose failures must always propagate.