DcsvIo.D2.AuthContext.Abstractions 0.1.1

DcsvIo.D2.AuthContext.Abstractions

Read-only IAuthContext interface — the typed contract domain code uses to reason about caller identity, organization, scopes, and impersonation context. Codegen-emitted from the auth-context contract spec by DcsvIo.D2.Context.SourceGen. Plus hand-written IAuthContextExtensions convenience helpers.

This is the domain-safe slice. Heavier runtime (HTTP middleware, JWT validation, population) is host-supplied. Sibling public package DcsvIo.D2.Context.Abstractions holds request-context interfaces + MutableRequestContext + propagation codecs.

Install

dotnet add package DcsvIo.D2.AuthContext.Abstractions

Public API

Spec → emitted shape

The auth-context contract spec declares 5 sections:

• Token + Trust: IsAuthenticated (trinary), Audience (IReadOnlyList<string> per RFC 7519 §4.1.3), SessionId, TokenIssuedAt, TokenExpiresAt, ActorChain (RFC 8693 flattened outermost-first)
• Identity: Subject (raw sub), UserId (sub parsed as Guid), Username, RequestedByClientId (RFC 8693 §4.3 / RFC 9068 — client that requested THIS token), ImmediateCallerClientId (derived — outermost Service in chain), OriginatingClientId (derived — most-deeply-nested Service in chain, fallback to Subject for pure service-identity tokens), IsServiceIdentity (derived)
• Organization: OrgId, OrgName, OrgType, OrgRole
• Impersonation: IsImpersonating (derived), ImpersonationKind (derived), ImpersonatedBy (derived), ImpersonationSessionId (derived), ImpersonatorOrgId / ImpersonatorOrgName / ImpersonatorOrgType / ImpersonatorOrgRole (derived)
• Scopes: Scopes

All D²-custom claim-mapped properties use d2_-prefixed claim names. Standard OAuth/OIDC claims (sub, aud, iat, exp, client_id, scope, act) keep their canonical names.

The five identity properties — when to use which

Extension methods (hand-written)

auth.HasScope("auth.password.change");
auth.HasAnyScope(Scopes.Self.Read, Scopes.Self.Write);
auth.HasAllScopes(Scopes.Auth.User.Impersonate.Consent, Scopes.Auth.Password.Change);

auth.IsStaff();                  // OrgType is Admin or Support
auth.IsAdmin();                  // OrgType is Admin

auth.IsForcedImpersonation();    // ImpersonationKind == Force
auth.IsConsentImpersonation();   // ImpersonationKind == Consent

auth.IsImpersonatorStaff();      // ImpersonatorOrgType is Admin or Support
auth.IsImpersonatorAdmin();      // ImpersonatorOrgType is Admin

Edge cases / gotchas

• HasAllScopes() with zero arguments returns true (vacuous truth — [].All(...) is true). Callers that pass a runtime-built array should guard the empty-input case if absence-of-scopes should be a denial.
• Scope comparison is case-sensitive per RFC 6749 §3.3. The runtime MutableRequestContext uses StringComparer.Ordinal when building the set; consumers must pass exact-case scope names.
• IsImpersonator* helpers are correct when not impersonating — ImpersonatorOrgType is null outside an impersonation context, so is OrgType.Admin or OrgType.Support short-circuits to false cleanly. Callers that want "this user is staff (regardless of impersonation)" should use IsStaff() instead.
• IsForcedImpersonation() and IsConsentImpersonation() are mutually exclusive but neither implies IsImpersonating — when not impersonating, both return false. Combine with IsImpersonating if your branch logic needs both flavor and presence.

Telemetry

None — this lib is read-only abstractions + pure-function extension methods. Callers (auth middleware, handlers, audit emitters) are responsible for any auth-related spans / counters.

Dependencies

• DcsvIo.D2.Auth.Abstractions — OrgType, Role, ActorKind, ImpersonationKind, ActorEntry
• DcsvIo.D2.Context.SourceGen — emits IAuthContext.g.cs (analyzer-only)

Sister packages: DcsvIo.D2.Auth.Abstractions, DcsvIo.D2.Context.Abstractions.