PrimusSaaS.Rbac 2.0.1

PrimusSaaS.Rbac

Release status: stable.

Core RBAC engine for Primus SaaS. Includes the data model, evaluation logic, and service interfaces. Storage adapters are shipped separately.

Validation

• Current workspace validation: 385/385 tests passed on net9.0
• Current workspace validation: 385/385 tests passed on net10.0
• Current workspace validation: total coverage 95.9% line / 86.34% branch / 98.09% method
• Scope boundary: core evaluator first; seeded/sample data is optional and not required for production usage

Telemetry

• Emits ActivitySource spans for decisions, snapshots, what-if checks, cleanup, and mutations.
• Emits exporter-agnostic metrics counters for decisions, mutations, and cleanup events.
• Consumers still need to wire their own exporter or MeterListener if they want the telemetry exported.
• The module intentionally keeps telemetry generic and backend-neutral.

Combined ASP.NET Core Host

If you are wiring RBAC together with PrimusSaaS.Identity.Validator and PrimusSaaS.MultiTenancy, use the verified combined onboarding guide at /docs/modules/combined-dotnet-integration.

Start here

• First-time package overview: /docs/modules/rbac
• Exact five-role, two-tenant access-control walkthrough: /docs/modules/rbac/verified-multi-tenant-role-matrix
• Same walkthrough under JWT authentication and membership-validated tenant selection, including tenant-scoped admin-role lifecycle validation: /docs/modules/rbac/verified-production-style-role-matrix
• First runnable SQL-backed path without EF Core: /docs/modules/rbac/verified-dapper-quickstart
• Initial host setup: /docs/modules/rbac/integration-guide
• Advanced topics such as caching, what-if evaluation, and telemetry: /docs/modules/rbac/advanced

Quick Start

using PrimusSaaS.Rbac;
using PrimusSaaS.Rbac.InMemory;

var services = new ServiceCollection();

services.AddPrimusRbacInMemory(options =>
{
    options.SeedMode = "none";
});

What it includes

• Scoped roles/permissions (application, tenant, qualifier)
• Deny-first evaluation with wildcard support
• Role hierarchy (single parent by default) and group hierarchy
• Attribute conditions (attributes on access requests)
• Role-based permission resolution (permissions only apply via roles)
• Optional audit sink for access checks and changes
• Snapshot, export/import, and what-if evaluation helpers
• Exporter-agnostic traces and metrics for decision flows

Storage adapters

• PrimusSaaS.Rbac.InMemory — in-process, no database required (dev/test)
• PrimusSaaS.Rbac.EFCore — Entity Framework Core (SQL Server, PostgreSQL, SQLite, ...)
• PrimusSaaS.Rbac.Dapper — Dapper micro-ORM (same databases, no EF dependency)
• PrimusSaaS.Rbac.Redis — Redis pub/sub distributed cache invalidation bus for multi-instance deployments

Distributed Cache Invalidation

When running multiple API replicas, each instance has its own IRbacDecisionCache. The IDistributedRbacInvalidationBus interface allows mutations on one instance to flush caches across all instances. Install PrimusSaaS.Rbac.Redis for a production-ready Redis pub/sub implementation:

builder.Services.AddPrimusRbacCore(opts => { /* ... */ });
builder.Services.AddPrimusRbacRedisInvalidation("redis:6379");

Ownership Policy

IRbacOwnershipPolicy enables resource-level ownership checks. After RBAC grants access, the ownership policy verifies the caller owns the specific resource instance:

services.AddSingleton<IRbacOwnershipPolicy, MyOwnershipPolicy>();

When a request includes a ResourceInstanceId, the policy's IsOwnerAsync is called. If it returns false, the decision is downgraded to deny with reason "ownership_check_failed".

Configuration

• SeedMode: none, minimal, or sample.
• minimal seeds only a generic permission placeholder; it does not create built-in roles.
• sample seeds demo roles and groups for local experimentation only.
• AllowMultipleInheritance: set true to allow more than one parent role.

Compliance note

This package is designed to support common enterprise access-control requirements. It does not provide certification. Align it with your organization's compliance program.