refactor(auth): migrate capability enforcement to native ASP.NET Core authorization - #37
Merged
Merged
Conversation
… authorization Replace the bespoke attribute/filter resolution with the framework pipeline: IAuthorizationRequirement + AuthorizationHandler + IAuthorizationPolicyProvider, keeping the endpoint filter as the enforcement boundary and preserving CapabilityForbiddenException (403 problem-details + access.denied audit). The policy provider synthesizes policies per capability code on demand, so the catalog needs no startup enumeration.
The seed CLI builds its own ServiceCollection without logging, but InitializeDatabaseAsync's baseline path resolves ILoggerFactory. Without AddLogging() the seed tool crashes on startup.
SiddharthaGF
temporarily deployed
to
refactor/capability-native-authorization - cynara-api PR #37
August 6, 2026 06:41 — with 
Render
Destroyed
Render
Destroyed
|
Neon branch ready. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RequireCapabilityAttribute+CapabilityAuthorizationFilterresolution to the native ASP.NET Core authorization pipeline:CapabilityRequirement(IAuthorizationRequirement),CapabilityAuthorizationHandler(AuthorizationHandler<CapabilityRequirement>), andCapabilityPolicyProvider(IAuthorizationPolicyProvider) that synthesizes a policy per capability code on demandIAuthorizationService; denials still raiseCapabilityForbiddenExceptionso the 403 problem-details body andaccess.deniedaudit are preserved unchangedIEffectiveCapabilityResolver, keeping the single memoized lookup per request shared by the filter, domain guards, and/api/me/capabilitiesFiles
src/Cynara.Api/CapabilityAuthorization/CapabilityRequirement.csIAuthorizationRequirementcarrying the capability codesrc/Cynara.Api/CapabilityAuthorization/CapabilityAuthorizationHandler.csIEffectiveCapabilityResolversrc/Cynara.Api/CapabilityAuthorization/CapabilityPolicyProvider.cssrc/Cynara.Api/CapabilityAuthorization/CapabilityAuthorizationFilter.csIAuthorizationService, keepsCapabilityForbiddenExceptionsrc/Cynara.Api/Hosting/ServiceCollectionExtensions.cstools/Cynara.Seed/Program.csAddLogging()soInitializeDatabaseAsyncbaseline resolvesILoggerFactoryTest plan
dotnet cake --target=Test— full suite green (incl. 28 capability tests)dotnet cake --target=FormatCheckand--target=Lint— greenaccess.deniedaudit rowsNotes
The seed-tool
AddLogging()fix is included because it was required to run the migration/seed flow (dotnet cake --target=Seed) against an empty database.Linear: