OwnershipGuard 0.2.0

OwnershipGuard

OwnershipGuard is an ASP.NET Core library that enforces ownership checks and optional tenant checks before endpoint or MVC action execution. It centralizes resource access validation by route id and helps prevent IDOR and broken access control caused by missing per-endpoint checks.

Requirements

• .NET 8
• ASP.NET Core 8

Installation

dotnet add package OwnershipGuard

<PackageReference Include="OwnershipGuard" Version="x.y.z" />

Quick Start

1. Register services.

using System.Security.Claims;

builder.Services.AddOwnershipGuard(options =>
{
    options.UserIdClaimType = ClaimTypes.NameIdentifier;
    options.TenantIdClaimType = "tenant_id";
    options.UseProblemDetailsResponses = true;
    options.HideExistenceWhenForbidden = false;
});

2. Register descriptors after builder.Build().

var app = builder.Build();
var registry = app.Services.GetRequiredService<IOwnershipDescriptorRegistry>();

// String key + ownership check
registry.Register<Note>(
    sp => sp.GetRequiredService<YourDbContext>().Notes,
    n => n.Id,
    n => n.OwnerId);

// Typed key (Guid) + ownership + tenant check
registry.Register<Document, Guid>(
    sp => sp.GetRequiredService<YourDbContext>().Documents,
    d => d.Id,
    d => d.OwnerId,
    tenantSelector: d => d.TenantId);

3. Apply the check to endpoints.

Minimal API:

app.MapGet("/documents/{id}", ...).RequireOwnership<Document>("id");
app.MapPut("/documents/{id}", ...).RequireOwnership<Document>("id");

MVC:

[ApiController]
[Route("documents")]
[RequireOwnership("id", typeof(Document))]
public sealed class DocumentsController : ControllerBase
{
    [HttpGet("{id}")]
    public IActionResult Get(string id) => Ok();
}

Response Behavior

Startup Validation (Fail-Fast)

OwnershipGuard validates ownership descriptors during startup.

• Minimal API endpoints are validated when configured with .RequireOwnership<TEntity>("id").
• MVC actions are validated when decorated with [RequireOwnership(...)].
• If a required descriptor is missing, app startup fails with InvalidOperationException and endpoint details.

Configuration

Optional error message overrides (when set, used as ProblemDetails.Title; when null, built-in defaults are used): MissingResourceIdMessage, InvalidResourceIdInRouteMessage, UnauthorizedMessage, TenantNotSpecifiedMessage, InvalidResourceIdMessage, NotFoundMessage, ForbiddenMessage, DescriptorNotRegisteredMessage. Useful for i18n or custom wording.

Optional Query Helpers

using OwnershipGuard.EntityFrameworkCore;

var ownedDocs = await db.Documents
    .WhereOwnedBy(userId, d => d.OwnerId)
    .ToListAsync();

var tenantDocs = await db.Documents
    .WhereTenant(tenantId, d => d.TenantId)
    .ToListAsync();

Non-Goals

OwnershipGuard does not implement:

• Authentication
• Authorization policy systems (RBAC)
• Rate limiting
• Input validation

License

MIT. See LICENSE.