RepletoryLib.Auth.Permissions 1.0.0

RepletoryLib.Auth.Permissions

Permission-based authorization with [RequirePermission] attribute and policy provider for ASP.NET Core.

Part of the RepletoryLib ecosystem -- standalone, reusable .NET 10 libraries with zero business logic.

Overview

RepletoryLib.Auth.Permissions adds declarative, permission-based authorization to ASP.NET Core. Instead of checking roles, you decorate controllers and actions with [RequirePermission("orders.read")] and the framework handles the rest through a custom IAuthorizationPolicyProvider and AuthorizationHandler.

Key Features

• [RequirePermission] attribute -- Declarative permission checks on controllers/actions
• Dynamic policy provider -- Auto-creates authorization policies from permission names
• ICurrentUserService integration -- Checks permissions via HasPermission()
• Fine-grained RBAC -- Permission-level control instead of coarse role checks

Installation

dotnet add package RepletoryLib.Auth.Permissions

Dependencies

Quick Start

using RepletoryLib.Auth.Permissions;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddRepletoryPermissions();

Usage Examples

Decorating Controllers

using RepletoryLib.Auth.Permissions.Attributes;

[ApiController]
[Route("api/[controller]")]
public class OrdersController : ControllerBase
{
    [HttpGet]
    [RequirePermission("orders.read")]
    public IActionResult GetOrders() => Ok(_orderService.GetAll());

    [HttpPost]
    [RequirePermission("orders.create")]
    public IActionResult CreateOrder(CreateOrderRequest request) => Ok(_orderService.Create(request));

    [HttpDelete("{id}")]
    [RequirePermission("orders.delete")]
    public IActionResult DeleteOrder(Guid id)
    {
        _orderService.Delete(id);
        return NoContent();
    }
}

How It Works

1. [RequirePermission("orders.read")] translates to policy name "Permission:orders.read"
2. PermissionPolicyProvider creates a policy with a PermissionAuthorizationRequirement
3. PermissionAuthorizationHandler calls ICurrentUserService.HasPermission("orders.read")
4. If the user has the permission, access is granted; otherwise, 403 Forbidden

Implementing ICurrentUserService

Your ICurrentUserService implementation must return true from HasPermission() for the user's assigned permissions:

public class HttpCurrentUserService : ICurrentUserService
{
    // ... other properties ...

    public bool HasPermission(string permission)
    {
        return _httpContext?.User.HasClaim("permission", permission) ?? false;
    }
}

Integration with Other RepletoryLib Packages

License

This project is licensed under the MIT License.

Copyright (c) 2024-2026 Repletory.

For complete documentation, infrastructure setup, and configuration reference, see the RepletoryLib main repository.