Stratara.Identity.EntityFrameworkCore 4.1.1

Prefix Reserved
There is a newer version of this package available.
See the version list below for details.
dotnet add package Stratara.Identity.EntityFrameworkCore --version 4.1.1
                    
NuGet\Install-Package Stratara.Identity.EntityFrameworkCore -Version 4.1.1
                    
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="Stratara.Identity.EntityFrameworkCore" Version="4.1.1" />
                    
For projects that support PackageReference, copy this XML node into the project file to reference the package.
<PackageVersion Include="Stratara.Identity.EntityFrameworkCore" Version="4.1.1" />
                    
Directory.Packages.props
<PackageReference Include="Stratara.Identity.EntityFrameworkCore" />
                    
Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.
paket add Stratara.Identity.EntityFrameworkCore --version 4.1.1
                    
#r "nuget: Stratara.Identity.EntityFrameworkCore, 4.1.1"
                    
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
#:package Stratara.Identity.EntityFrameworkCore@4.1.1
                    
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.
#addin nuget:?package=Stratara.Identity.EntityFrameworkCore&version=4.1.1
                    
Install as a Cake Addin
#tool nuget:?package=Stratara.Identity.EntityFrameworkCore&version=4.1.1
                    
Install as a Cake Tool

Stratara.Identity.EntityFrameworkCore

Derived. The behaviour described here is specified under openspec/specs/. Those specifications are the source; this page explains and illustrates them.

EF Core identity-directory plane for the Stratara stack: user↔tenant membership (many-to-many with tenant-scoped roles), active-tenant selection, and membership-backed authorization.

Contents

  • IdentityDirectoryDbContext<TContext> — standalone DbContext hosting all four directory tables (tenant_membership, active_tenant, setting_entry, api_key); derive a concrete context and own its migrations. To fold these into an existing context instead, call modelBuilder.ApplyIdentityDirectoryModel() in its OnModelCreating.
  • ModelBuilder.ApplyIdentityDirectoryModel() — adds the same tables to an existing context (for example your ASP.NET Identity context) so they share one migration lineage.
  • AddTenantMembershipStore<TContext>() — EF-backed ITenantMembershipStore: forward lookup (a user's tenants), reverse lookup (a tenant's members), upsert, GDPR sweeps per user/tenant, and membership-guarded active-tenant switching.
  • MembershipAuthorizationProvider / MembershipAuthorizationProvider<TUser> — the framework's default IAuthorizationProvider: role checks pass on tenant-scoped membership roles, the TUser variant additionally on global ASP.NET Identity roles (platform roles).
  • AddMembershipCrossTenantAuthorizer(...) — membership-backed ICrossTenantAuthorizer for strict tenant isolation, with configurable cross-tenant roles for the operator-impersonation path (platform administrators without membership in the target tenant).
  • AddPermissionCatalog(...) + AddCatalogPermissionResolver[<TUser>]() — the application's code-declared permission vocabulary with role grants, resolved from membership roles (and optionally global ASP.NET Identity roles) for [RequirePermission] enforcement and HTTP permission policies.
  • AddApiKeyStore<TContext>() — API keys and personal access tokens: stk_-prefixed 256-bit keys (hash-only storage), fail-closed validation with expiry/revocation, erasure sweeps. Machine keys are materialized as tenant memberships, so they flow through the same role/permission plane as human actors; PATs act as their bound user. ImportAsync stores a machine key the caller already holds (generated with ApiKeyFormat.CreateRawKey()) for setups where the key must exist before boot — idempotent, never mutating an already-stored key.
  • AddSettingCatalog(...) + AddSettingStore<TContext>() — scoped settings plane: code-declared SettingDefinitions, row-per-key EF storage (setting_entry), a Subject-fed ISettingProvider fallback chain (user-in-tenant → user → tenant → global → configuration → default), transparent AES-GCM encryption for IsEncrypted definitions, and per-user/per-tenant erasure sweeps.
  • AddTenantMembershipStoreFromContextFactory<TContext>(), AddApiKeyStoreFromContextFactory<TContext>(), AddSettingStoreFromContextFactory<TContext>() — the same three stores, taking a fresh context per operation from IDbContextFactory<TContext> instead of sharing the request's. See below.

One context for the request, or one per operation

The plain registrations give every directory store in a request the same context instance. A database context serves one operation at a time, so directory work issued concurrently inside one request fails on whichever operation arrives second — at the call site that lost the race, not the one that introduced the concurrency. Sharing also means a store's own commit commits whatever else the consumer has left unsaved on that context.

The …FromContextFactory variants remove both: each operation creates its own context and disposes it. In exchange, a store write no longer takes part in a transaction the consumer opened on their own scoped context. That trade is why the shared registration stays the default rather than being replaced.

They require AddDbContextFactory<TContext>(); a missing registration fails at first resolution. Keep the factory's options aligned with the scoped registration — interceptors, query filters and conventions are configured per registration, not per context type. Calling both variants for the same store leaves whichever ran first in place; they do not compose.

Dependencies

  • Microsoft.EntityFrameworkCore (+ Relational)
  • Microsoft.Extensions.Identity.Core
  • Stratara.Abstractions

Used together with Stratara.Mediator (authorizing mediator, tenant isolation) and Stratara.Identity.AspNetCore (sign-in claims bridge).

Product Compatible and additional computed target framework versions.
.NET net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
4.2.0 46 9/18/2026
4.1.1 61 9/16/2026
4.1.0 78 9/16/2026
4.0.4 679 9/14/2026
4.0.3 112 9/3/2026
4.0.2 594 9/3/2026
4.0.1 225 9/2/2026
4.0.0 615 8/31/2026
4.0.0-preview.1 67 8/31/2026
3.4.0 135 8/28/2026
3.3.0 332 8/25/2026
3.2.3 104 8/22/2026
3.2.2 729 8/14/2026
3.2.1 360 8/2/2026
3.2.0 114 7/18/2026

Correctness fixes for the Orleans execution model ahead of production use. Recorded commands can no longer
reach a bus drain, a durable timer fires once however long its handler runs, and heavy commands are
specified as the exception to the one-writer-per-aggregate promise they always were. The execution-model
reset removes only the host's own checkpoints, and three store-level fixes land for the partition
counter, its backfill and a checkpoint's first write. No schema change; **stop every bus outbox worker
before upgrading hosts that record commands through the execution model**, and register
`AddStrataraIntentStore` on the silos that run the drain.

### Changed

- **Orleans: the execution-model reset removes only the checkpoints of the host's own projections and
 sagas.** It removed every checkpoint in the read store, so a reset in one deployment made another
 deployment sharing the read store rebuild its projections unasked. The reset now removes the
 checkpoints of the projections and sagas registered in the composition it is resolved from, and the
 report counts only those. A checkpoint of a projection the host no longer registers stays; nothing
 reads it. Resolve the reset from the host's own composition — one that registers no store reader
 removes no checkpoint.
- **The documentation states when a read store can be shared.** Checkpoints are keyed by consumer, not
 by deployment: deployments sharing a read store need distinct projection names, and at most one of
 them runs `AddStrataraSagaGrains`.
- **Orleans: heavy commands are specified as running outside their aggregate's turn and order.** They
 always ran in their own bounded pool beside the aggregate's other commands; the specification promised
 otherwise. Their hand-over no longer holds the per-aggregate send order either: a command dispatched after
 a heavy command for the same aggregate no longer waits for it, and two due heavy commands on one aggregate
 no longer hold up the drain's resume pass. Where a heavy command and another command on the same aggregate
 both append, the store's version check refuses the later one, which is resumed like any failing command.
- **Orleans: a recorded command is stored under a kind of its own.** No bus outbox drain reads it any more.
 Commands recorded under 4.1.0 are still resumed; stop every bus outbox worker before upgrading hosts that
 record commands.

### Fixed

- **Orleans: the outbox drain no longer publishes recorded commands to the bus.** It chose between resuming
 recorded commands and publishing stored commands by whether the execution model's dispatcher was
 registered on its own silo, and the migration guide registers the dispatcher on the API host and the drain
 on the silos. Such a silo handed every recorded command — kept ones included — to the bus: commands ran
 twice, kept commands came back, the attempt bound did not hold. The drain now resumes recorded commands
 wherever an intent store is registered and warns (`117_111`) where recorded commands exist but none is.
 Register `AddStrataraIntentStore` on the silos that run the drain.
- **Orleans: a durable timer fires once however long its handler runs.** A handler that outlasted the
 reminder call's response timeout was started again by the next tick. A tick that arrives while the same
 timer's handler runs now does nothing, and a tick confirms its timer is still registered before firing.

- **Orleans: two writers of the same first checkpoint no longer fail one of them.** When an
 activation and its successor overlap during a failover, both can find no checkpoint row and both
 insert it; the one that lost to the key threw. It now updates the row the other inserted.
- **Orleans: the partition counter works on a model that does not use snake-case names.** The
 interceptor advanced the counter with SQL naming `partition_position` and its columns literally, so
 a write context mapping the counter under other names failed every append. It now goes through the
 context's model, as the native reader already did.
- **Orleans: the partition-counter backfill positions old entries in the order they were appended.**
 It ordered each partition's history by bucket first, so a projection or saga reading across
 aggregates saw the facts of one bucket before earlier facts of another. Entries are now positioned
 in sequence order, as the event-sourcing-store specification already promised. A store backfilled
 under 4.1.0 keeps the positions it was given; the backfill does not reposition entries.