OwnershipGuard 0.1.0

OwnershipGuard

OwnershipGuard is an ASP.NET Core library that enforces ownership checks and optional tenant checks before endpoint or MVC action execution. It centralizes resource access validation by route id and helps prevent IDOR and broken access control caused by missing per-endpoint checks.

Requirements

• .NET 8
• ASP.NET Core 8

Installation

dotnet add package OwnershipGuard

<PackageReference Include="OwnershipGuard" Version="x.y.z" />

Quick Start

1. Register services.

using System.Security.Claims;

builder.Services.AddOwnershipGuard(options =>
{
    options.UserIdClaimType = ClaimTypes.NameIdentifier;
    options.TenantIdClaimType = "tenant_id";
    options.UseProblemDetailsResponses = true;
    options.HideExistenceWhenForbidden = false;
});

2. Register descriptors after builder.Build().

var app = builder.Build();
var registry = app.Services.GetRequiredService<IOwnershipDescriptorRegistry>();

// String key + ownership check
registry.Register<Note>(
    sp => sp.GetRequiredService<YourDbContext>().Notes,
    n => n.Id,
    n => n.OwnerId);

// Typed key (Guid) + ownership + tenant check
registry.Register<Document, Guid>(
    sp => sp.GetRequiredService<YourDbContext>().Documents,
    d => d.Id,
    d => d.OwnerId,
    tenantSelector: d => d.TenantId);

3. Apply the check to endpoints.

Minimal API:

var documentOwnership = new RequireOwnershipFilter("id", typeof(Document));
app.MapGet("/documents/{id}", ...).AddEndpointFilter(documentOwnership);
app.MapPut("/documents/{id}", ...).AddEndpointFilter(documentOwnership);

MVC:

[ApiController]
[Route("documents")]
[RequireOwnership("id", typeof(Document))]
public sealed class DocumentsController : ControllerBase
{
    [HttpGet("{id}")]
    public IActionResult Get(string id) => Ok();
}

Response Behavior

Configuration

Optional Query Helpers

using OwnershipGuard.EntityFrameworkCore;

var ownedDocs = await db.Documents
    .WhereOwnedBy(userId, d => d.OwnerId)
    .ToListAsync();

var tenantDocs = await db.Documents
    .WhereTenant(tenantId, d => d.TenantId)
    .ToListAsync();

Non-Goals

OwnershipGuard does not implement:

• Authentication
• Authorization policy systems (RBAC)
• Rate limiting
• Input validation

License

MIT. See LICENSE.