Cayaqui.MPS.Authorization 0.1.0

Cayaqui.MPS.Authorization

Business authorization layer for MPS Blazor apps (.NET 10 Blazor WebApp Interactive Server).

What's included

Quick start

// Program.cs
using MPS.Authorization.Extensions;

builder.Services.AddMpsAuthorization(o =>
    o.UseSqlServer(connectionString));   // or UseInMemoryDatabase for dev

// Register your IMpsCurrentUser implementation (Scoped)
builder.Services.AddScoped<IMpsCurrentUser, YourCurrentUser>();

MpsAuthorizeView

@using MPS.Authorization.Domain

<MpsAuthorizeView Permission="@MpsPermissions.Budget.Approve" ProjectId="@projectId">
    <button>Aprobar Presupuesto</button>
</MpsAuthorizeView>

<MpsAuthorizeView Role="@MpsRoles.ProjectManager" ProjectId="@projectId">
    <Authorized>
        <button>Editar</button>
    </Authorized>
    <NotAuthorized>
        <span>Solo lectura</span>
    </NotAuthorized>
</MpsAuthorizeView>

Implementing IMpsCurrentUser

// Scoped — loaded once per Blazor circuit
public sealed class CurrentUser : IMpsCurrentUser
{
    private readonly IMpsAuthorizationService _authService;
    private IReadOnlyList<UserRoleAssignment>? _assignments;

    public CurrentUser(IHttpContextAccessor http, IMpsAuthorizationService authService)
    {
        _authService = authService;
        var claims = http.HttpContext?.User;
        IsAuthenticated = claims?.Identity?.IsAuthenticated ?? false;
        Id = IsAuthenticated ? Guid.Parse(claims!.FindFirstValue(ClaimTypes.NameIdentifier)!) : null;
        Email = claims?.FindFirstValue(ClaimTypes.Email);
        DisplayName = claims?.FindFirstValue("name");
    }

    public Guid? Id { get; }
    public string? Email { get; }
    public string? DisplayName { get; }
    public string? PhotoUrl { get; set; }   // set after photo URL is resolved
    public bool IsAuthenticated { get; }
    public bool IsSuperAdmin => RoleAssignments.Any(r => r.Role == MpsRoles.SuperAdmin);

    public IReadOnlyList<UserRoleAssignment> RoleAssignments =>
        _assignments ??= Id.HasValue
            ? _authService.GetUserRolesAsync(Id.Value).GetAwaiter().GetResult()
            : [];

    public bool IsInRole(string role, Guid? projectId = null) =>
        IsSuperAdmin || RoleAssignments.Any(r =>
            r.Role == role && (r.ProjectId is null || r.ProjectId == projectId));

    public bool HasPermission(string permission, Guid? projectId = null) =>
        IsAuthenticated && _authService.HasPermission(RoleAssignments, permission, projectId);
}

Role → Permission matrix

Auth models

This package is auth-provider agnostic. Two deployment models are supported:

Entra ID: Admin pre-registers email → user logs in with Entra → IMpsUserService.FindByEmailAsync provisions the record → photo downloaded via Graph API and stored via Cayaqui.MPS.Storage.

Local auth: Standard ASP.NET Core Identity with MFA (Email OTP / SMS OTP / TOTP). Same AppUser entity extended with Identity columns.