Winglet.Authentication 0.1.2

Winglet.Authentication

Winglet.Authentication is the shared integration boundary between native ASP.NET Core JWT Bearer validation and the immutable Winglet request context. ASP.NET Core / IdentityModel owns bearer extraction, signature, issuer, lifetime, key and clock-skew validation; this package adds the fixed canonical JWT v1 profile checks and establishes trusted TenantContext.

The application-facing context keeps Identity, Session, Service caller, Tenant, Authentication, actor and authorization snapshots separate. Global-context tokens have no tenant. Tenant-context tokens contain exactly one tenant and only that tenant's broad authorization snapshot. Service-only and on-behalf-of tokens preserve caller/actor distinction.

Register the package with AddWingletAuthentication(configuration), run UseAuthentication() first, then UseWingletAuthenticationContext(). Add AddWingletAuthorization() when using the supplied privilege, assurance, freshness or tenant-context policy handlers. The package never trusts tenant values from request body, query or headers and never exposes raw claims as the primary API.

Use RequireWingletPrivilege("event.manage"), RequireWingletAuthenticationAssurance(WingletAuthenticationAssurance.Strong), RequireWingletAuthenticationFreshness(...) and RequireWingletTenantContext() in normal ASP.NET Core policies. Canonical privilege matching is centralized; roles and groups are not the application authorization API.

Canonical wire details are defined by docs/contracts/authentication/jwt-v1.md. The canonical profile requires winglet+jwt, RS256, an opaque kid, exact configured issuer, exp, iat, 60-second clock skew, canonical claim types and explicit global/tenant context. No per-request Identity/Auth lookup is performed.

Outbound IWingletClientTokenProvider integration is implemented by WingletAuthenticationTokenProvider. It validates operation-declared global/tenant and service-only/on-behalf-of semantics against the trusted current context, then delegates the replaceable remote operation to IWingletAuthenticationTokenAcquirer. No token endpoint, PHP implementation detail, JWT cryptography or credentials are embedded in this package.

The current PHP Identity token shape is a compatibility concern for the configured JwtBearer validation and token acquirer: legacy claim names can be mapped through the contained adapter, but the package does not silently treat a custom HMAC token format as a standard JWT deployment. The same semantic context and acquirer boundary can be used by a future C# Identity/Auth implementation.