PrimusSaaS.Rbac 2.0.0

PrimusSaaS.Rbac

Release status: stable.

Core RBAC engine for Primus SaaS. Includes the data model, evaluation logic, and service interfaces. Storage adapters are shipped separately.

Validation

• Current workspace validation: 181/181 tests passed on net8.0
• Current workspace validation: 181/181 tests passed on net9.0
• Current workspace validation: 181/181 tests passed on net10.0
• Current workspace validation: total coverage 96.31% line / 84.29% branch / 96.56% method
• Scope boundary: core evaluator first; seeded/sample data is optional and not required for production usage

Telemetry

• Emits ActivitySource spans for decisions, snapshots, what-if checks, cleanup, and mutations.
• Emits exporter-agnostic metrics counters for decisions, mutations, and cleanup events.
• Consumers still need to wire their own exporter or MeterListener if they want the telemetry exported.
• The module intentionally keeps telemetry generic and backend-neutral.

Combined ASP.NET Core Host

If you are wiring RBAC together with PrimusSaaS.Identity.Validator and PrimusSaaS.MultiTenancy, use the verified combined onboarding guide at /docs/modules/combined-dotnet-integration.

Start here

• First-time package overview: /docs/modules/rbac
• Initial host setup: /docs/modules/rbac/integration-guide
• Advanced topics such as caching, what-if evaluation, and telemetry: /docs/modules/rbac/advanced

Quick Start

using PrimusSaaS.Rbac;
using PrimusSaaS.Rbac.InMemory;

var services = new ServiceCollection();

services.AddPrimusRbacInMemory(options =>
{
    options.SeedMode = "none";
});

What it includes

• Scoped roles/permissions (application, tenant, qualifier)
• Deny-first evaluation with wildcard support
• Role hierarchy (single parent by default) and group hierarchy
• Attribute conditions (attributes on access requests)
• Role-based permission resolution (permissions only apply via roles)
• Optional audit sink for access checks and changes
• Snapshot, export/import, and what-if evaluation helpers
• Exporter-agnostic traces and metrics for decision flows

Storage adapters

• PrimusSaaS.Rbac.InMemory
• PrimusSaaS.Rbac.EFCore

Configuration

• SeedMode: none, minimal, or sample.
• minimal seeds only a generic permission placeholder; it does not create built-in roles.
• sample seeds demo roles and groups for local experimentation only.
• AllowMultipleInheritance: set true to allow more than one parent role.

Compliance note

This package is designed to support common enterprise access-control requirements. It does not provide certification. Align it with your organization's compliance program.