Trellis.Microservices.AspNetCore 0.1.0-alpha.76

Trellis.Microservices.AspNetCore

Consumer-side counterpart to Trellis.Yarp. Hydrates the full Trellis Actor (id + permissions + forbidden permissions + ABAC attributes) from a verified gateway-minted internal JWT, enforcing the strict sentinel + count claim contract that defends the deny-overrides-allow invariant against a proxy stripping the deny set.

Usage

One call wires the strict AddJwtBearer profile and the actor provider together so they cannot drift:

builder.Services.AddTrellisInternalJwtBearer(
    issuer: "https://gateway.internal",
    audience: "incidents-service",
    configureActor: o =>
    {
        o.RequiredAttributes = ["tenant_id"];        // fail closed on a missing tenant claim
        o.AttributeClaimMap["tenant_id"] = "tid";
    });

It re-applies the security-critical invariants (MapInboundClaims = false, TryAllIssuerSigningKeys = false, RequireSignedTokens, validate iss/aud/lifetime, ValidAlgorithms = ["RS256"]) after any configureJwtBearer, so the loose-profile footgun cannot be reintroduced. It pulls in Microsoft.AspNetCore.Authentication.JwtBearer, so it is not trim/AOT-safe — for an AOT host (or an algorithm the helper does not pin), register your scheme yourself and pair it with AddTrellisInternalJwtActorProvider:

builder.Services.AddAuthentication("Bearer").AddJwtBearer(o =>
{
    o.Authority = "https://gateway.internal";
    o.Audience = "incidents-service";
    o.MapInboundClaims = false;     // keep raw JWT claim names
    o.SaveToken = false;
    o.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true, ValidIssuer = "https://gateway.internal",
        ValidateAudience = true, ValidAudience = "incidents-service",
        ValidateLifetime = true, RequireSignedTokens = true,
        ValidAlgorithms = ["RS256"],
        ClockSkew = TimeSpan.FromSeconds(30),
        TryAllIssuerSigningKeys = false,
    };
});
builder.Services.AddTrellisInternalJwtActorProvider(o =>
{
    o.RequiredAttributes = ["tenant_id"];
    o.AttributeClaimMap["tenant_id"] = "tid";
    o.ExpectedIssuer = "https://gateway.internal";
    o.ExpectedAudience = "incidents-service";
});

The previous TrellisServiceBuilder.UseTrellisInternalJwtActor slot in upstream Trellis.ServiceDefaults was removed in v3 cleanup when this provider moved here; call AddTrellisInternalJwtActorProvider(...) directly as shown above.

Pairs with

• Trellis.Yarp — the gateway-side counterpart that mints these JWTs.
• Trellis.Microservices.Abstractions (transitive) — shared TrellisInternalJwtClaimNames contract literals.

Documentation

Full reference: trellis-api-internal-jwt.md.

End-to-end recipe: trellis-api-microservices-cookbook.md.

Optional AgentDocs setup

This package includes a versioned API reference, but restoring it does not install agent instructions. To opt in, restore your consuming project or solution, then run from its Git root:

dotnet new tool-manifest --output .config
dotnet tool install Trellis.AgentDocs --version 0.1.0-preview.20 --tool-manifest .config/dotnet-tools.json
dotnet tool run agentdocs init <solution-or-project>

If the repository already has .config/dotnet-tools.json, reuse it. Restoring the package never activates its guide: init lists Trellis.Microservices.AspNetCore as pending and prints the package IDs to add to approvedPackages in .agentdocs/policy.json. Add the package IDs you trust, then run dotnet tool run agentdocs sync. After a package upgrade, restore and run sync again.

Companion links use declared cross-package references, not copied guides. Approve the other trusted, restored guidance publishers as needed; Trellis.Core owns the upstream guides. References never add dependencies or grant approval. Unavailable or unapproved targets become notices; use dotnet tool run agentdocs sync --strict-references to reject them instead.

License

MIT.