HMS.Shared.Authorization 2.9.5

HMS.Shared.Authorization

Lightweight, high-performance token authorization library for HMS modular systems (Hospital Management System).

This package provides [TokenAuthorize] and GlobalAuthorizationActionFilter for validating tokens sent in the JSON body instead of headers. It validates JWT tokens using a shared symmetric key (from appsettings) and compares the user identity as a combination of tenant name + user name.

✨ Features

• Simple attribute-based authorization: [TokenAuthorize]
• Token verification handled automatically via GlobalAuthorizationActionFilter
• Key and token validation logic configurable via HmsAuth section in appsettings.json
• Supports multi-tenant HMS architecture (tenant + hospital)
• Lightweight — only a few kilobytes of dependencies
• Designed for .NET 8 and ASP.NET Core Web APIs

📦 Installation

Add the NuGet package:

dotnet add package HMS.Shared.Authorization

⚙️ Configuration

Add an HmsAuth section in your appsettings.json:

{
  "HmsAuth": {
    "Base64Secret": "YOUR_BASE64_SYMMETRIC_KEY_IN_BASE64",
    "ValidateLifetime": true,
    "ClockSkewSeconds": 60,
    "ValidateIssuer": false,
    "ValidateAudience": false
  }
}

🛠️ The Base64Secret is a Base64-encoded symmetric key used to validate JWT signatures.

🚀 Usage

1️⃣ Add service registration

In your Program.cs of the consuming project (e.g., OPD module):

using HMS.Shared.Authorization;

builder.Services.AddHmsTokenAuth(builder.Configuration);

builder.Services.AddControllers(o =>
        o.Filters.AddService<GlobalAuthorizationActionFilter>());

2️⃣ Apply [TokenAuthorize]

[TokenAuthorize]
[HttpPost("GetAllPatientSchedule")]
public async Task<ActionResult<OpdPatientScheduleListViewModel>> GetAllPatientScheduleAsync(
    OpdPatientScheduleViewModel objModel,
    CancellationToken cancellationToken = default)
{
    return Ok(await _opdService.GetAllPatientScheduleAsync(objModel, cancellationToken));
}

🧩 How it works

• The action filter automatically checks for [TokenAuthorize].
• It extracts _tenantName, _userName, and _token from the incoming model.
• It verifies the token using the symmetric key from configuration.
• If valid, the request continues; otherwise, a JSON error response is returned.

👤 Author

Ratul Koley

🏢 Maintainer

Xcelcure Technologies LLP. — private HMS modularization project.

📄 License

This package is proprietary software for HMS internal use.