RA.Utilities.Authorization

Version 10.0.4

Maintenance release — no API, behavior, or dependency changes.

Version 10.0.3

AddUserContext() now registers the IUserContext interface and no longer registers IHttpContextAccessor as a side effect — register IHttpContextAccessor explicitly. The extension classes are refactored to C# 14 extension members.

⚠️ Breaking Changes

• AddUserContext() no longer registers IHttpContextAccessor: the UserContext implementation requires it, but the registration is now left to the application. Migration:

+ builder.Services.AddHttpContextAccessor();
  builder.Services.AddUserContext();

🔧 Fixes & Improvements

• Fixed IUserContext resolution: AddUserContext() now registers AddScoped<IUserContext, UserContext>(). In v10.0.2 only the internal UserContext class was registered, so injecting IUserContext failed with InvalidOperationException: No service for type 'RA.Utilities.Authorization.IUserContext' has been registered.
• C# 14 extension members: ClaimsPrincipalExtensions and DependencyInjectionExtensions now declare their methods inside extension(...) blocks. Class names, namespaces, method names, and signatures are unchanged — no call-site changes.

---

Version 10.0.2

AppUser is replaced by the IUserContext abstraction with an internal UserContext implementation, and registration moves from AddAppUser() to AddUserContext().

⚠️ Breaking Changes

• AppUser removed: the concrete AppUser class is replaced by the IUserContext interface (implemented internally by UserContext). Inject IUserContext instead of AppUser. Migration:

- builder.Services.AddAppUser();
+ builder.Services.AddUserContext();

- public OrdersController(AppUser user) => _user = user;
+ public OrdersController(IUserContext user) => _user = user;

• Registration lifetime changed to scoped: AddUserContext() registers the service as scoped (was transient). Migration: no action needed for typical request-scoped usage; the service remains safe to inject into controllers, Minimal API endpoints, and services.

✨ New Features

• IUserContext interface: defines the full contract — IsAuthenticated, Id, UserId, Email, Name, GetClaimValue, GetClaimValues, HasClaim, HasScope, IsInRole — so consumers can mock it directly in unit tests without mocking IHttpContextAccessor.

---

Version 10.0.1

🔧 Fixes & Improvements

• Fixed HasClaim signature: HasClaim(string claimValue) → HasClaim(string claimType, string claimValue). The old signature hardcoded the claim type to "claim" which never matched real auth provider claims. The new two-parameter signature matches standard ClaimsPrincipal.HasClaim(type, value).
• Fixed HasScope for OIDC compliance: HasScope now splits space-separated scope values per the OAuth 2.0 standard. A "scope" claim with value "api.read api.write" now correctly matches individual scopes.
• New Guid UserId on AppUser: Typed access to the user ID without calling the extension method. Throws InvalidOperationException if the user is not authenticated or the claim is invalid.
• Null validation: AppUser constructor now throws ArgumentNullException for null IHttpContextAccessor.
• Removed FindFirstValue extension: Shadowed the built-in ClaimsPrincipal.FindFirstValue(string) method. Use the built-in directly.
• GetUserId exception type: Throws InvalidOperationException instead of ApplicationException.

⚠️ Breaking Change

HasClaim(string claimValue) → HasClaim(string claimType, string claimValue). Update callers to provide both a claim type and value.

Version 10.0.0

Update the project file to transition from release candidate 10.0.0-rc.2 to the final stable release 10.0.0. This signifies that the code is considered stable and ready for production use, reflecting confidence in its readiness and addressing any issues identified during the release candidate phase.

Version 10.0.0-rc.2

This release marks a major evolution of the RA.Utilities.Authorization package, shifting its focus from a simple current user service to a powerful, claims-based authorization system. The package now provides a flexible and maintainable way to implement permission-based security in ASP.NET Core applications.

🚀 Features & Enhancements

• Permission-Based Authorization: Introduced the [HasPermission] attribute to protect endpoints with granular permissions, moving away from role-based checks.
• Dynamic Policy Provider: Implemented IAuthorizationPolicyProvider to dynamically create authorization policies based on permissions required by the [HasPermission] attribute. This eliminates the need to pre-register every policy.
• Simplified Setup: Added the AddPermissionAuthorization() extension method to register all necessary services for permission-based authorization with a single line of code.
• Custom Requirement and Handler: Created PermissionRequirement and PermissionAuthorizationHandler to perform the core logic of checking a user's "permissions" claim against the required permission.
• Comprehensive README.md: The package documentation has been completely rewritten to reflect the new functionality, with clear examples for both controller-based and minimal APIs.

Breaking Changes

• Deprecation of ICurrentUser: The ICurrentUser interface and AppUser class have been removed. The focus of this package is now solely on authorization. Accessing user claims should be done directly via HttpContext.User.
• Removed AddCurrentUser: The AddCurrentUser() extension method has been replaced by AddPermissionAuthorization().

---