الصلاحيات وحدود الموارد

using System;
using System.Security.Claims;
using Microsoft.AspNetCore.Authorization;
using Microsoft.Extensions.DependencyInjection;

var services = new ServiceCollection();
services.AddLogging();
services.AddAuthorization(options => options.AddPolicy("ReadReports", policy => policy.RequireAuthenticatedUser().RequireClaim("scope", "reports.read")));
using var provider = services.BuildServiceProvider();
var authorization = provider.GetRequiredService<IAuthorizationService>();
var reader = new ClaimsPrincipal(new ClaimsIdentity(new[] { new Claim("scope", "reports.read") }, "synthetic"));
var empty = new ClaimsPrincipal(new ClaimsIdentity());
bool allowed = (await authorization.AuthorizeAsync(reader, null, "ReadReports")).Succeeded;
bool denied = (await authorization.AuthorizeAsync(empty, null, "ReadReports")).Succeeded;
Console.WriteLine($"reader={allowed} empty={denied}");

reader=True empty=False

لا يستوفي المتطلبين إلا القارئ الاصطناعي؛ ولا يشارك رمز أو خط برمجيات وسيطة يعمل داخل مضيف.

using System;
using System.Security.Claims;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authorization;

var user = new ClaimsPrincipal(new ClaimsIdentity(new[] { new Claim(ClaimTypes.NameIdentifier, "u1"), new Claim("tenant", "t1") }, "synthetic"));
var requirement = new OwnerRequirement();
var allowed = new AuthorizationHandlerContext(new[] { requirement }, user, new Report("u1", "t1"));
var wrongTenant = new AuthorizationHandlerContext(new[] { requirement }, user, new Report("u1", "t2"));
var handler = new OwnerHandler();
await handler.HandleAsync(allowed);
await handler.HandleAsync(wrongTenant);
Console.WriteLine($"owner={allowed.HasSucceeded} wrongTenant={wrongTenant.HasSucceeded}");

internal sealed class OwnerRequirement : IAuthorizationRequirement { }
internal sealed record Report(string Owner, string Tenant);
internal sealed class OwnerHandler : AuthorizationHandler<OwnerRequirement, Report>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, OwnerRequirement requirement, Report resource)
    {
        if (context.User.FindFirst(ClaimTypes.NameIdentifier)?.Value == resource.Owner && context.User.FindFirst("tenant")?.Value == resource.Tenant)
            context.Succeed(requirement);
        return Task.CompletedTask;
    }
}

owner=True wrongTenant=False

يمر المورد الاصطناعي ذو المالك والمستأجر المطابقين، ولا يمر المورد ذو المستأجر المختلف.