RePolicies.AspNetCore 1.0.0

RePolicies.AspNetCore

ASP.NET Core integration for RePolicies.

This package builds a Policy<TModel> envelope from the current HttpContext and lets you enforce the configured policies three ways: manually in a handler, as an authorization (endpoint) filter, or as global middleware. All three produce the same denial response (403 by default).

The policy model, engine and runtime reconfiguration live in the core RePolicies package — start there for how policies are defined and reconfigured. This package adds the HTTP layer.

Install

dotnet add package RePolicies.AspNetCore

Setup

using RePolicies.AspNetCore;
using RePolicies.DependencyInjection;

builder.Services.AddRePolicies();      // core engine (calls AddReValidator())
builder.Services.AddRePoliciesHttp();  // IPolicyFactory + enforcement options

builder.Services.AddPolicy<CreateOrderRequest>(new PolicyDefinition
{
    Name = "TenantHeaderRequired",
    Expression = "x => x.HasHeader(\"X-Tenant-Id\")",
    DenialReason = "The X-Tenant-Id header is required."
});

AddRePoliciesHttp() registers IPolicyFactory (the HttpContext → Policy<TModel> builder) and the shared PolicyEnforcementOptions.

Enforcing policies

1. Manual evaluation

Most control. Resolve IPolicyFactory + IPolicyEngine and decide what to return:

app.MapPost("/orders", (CreateOrderRequest req, HttpContext ctx,
                        IPolicyEngine engine, IPolicyFactory factory) =>
{
    var policy = factory.Create(req, ctx);   // wraps body + request context
    var result = engine.Evaluate(policy);

    return result.IsSatisfied
        ? Results.Ok()
        : Results.Json(new { result.Failures }, statusCode: 403);
});

2. As an authorization (endpoint) filter

RequirePolicies<TModel>() attaches PolicyEndpointFilter<TModel>, which evaluates the policies after model binding and short-circuits with the denial response — the handler only runs for allowed requests:

app.MapPost("/orders", (CreateOrderRequest req) => Results.Ok())
   .RequirePolicies<CreateOrderRequest>();

// Also available on route groups:
var orders = app.MapGroup("/orders").RequirePolicies<CreateOrderRequest>();

3. As global middleware

UseRePolicies() enforces policies centrally, before the endpoint executes. It only acts on endpoints marked with WithPolicyModel<TModel>() (everything else passes through), reading and rewinding the request body so normal model binding still works:

app.UseRePolicies();   // after routing, before endpoint execution

app.MapPost("/orders", (CreateOrderRequest req) => Results.Ok())
   .WithPolicyModel<CreateOrderRequest>();

Pick one mechanism per endpoint — attaching both simply evaluates twice.

Customising the denial response

Configure PolicyEnforcementOptions (used by both the filter and the middleware) via AddRePoliciesHttp:

builder.Services.AddRePoliciesHttp(options =>
{
    options.DeniedStatusCode = StatusCodes.Status403Forbidden;
    options.ResponseBodyFactory = result => new { errors = result.Failures };
    // options.JsonSerializerOptions = ...
});

The default body is { "denied": [ { "policyName": ..., "reasons": [...] } ] }.

Key types

Extension methods

License

MIT.