ilpanich / axiam-csharp-sdk / 29515414367

92%

push

github

feat(aspnetcore): add AxiamAccessAttribute with scope + route-param resolution (CONTRACT §11) (#12)

* docs(contract): sync CONTRACT.md §11 declarative authorization helpers

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5foj8NVCeS9qUW94kJ13g

* feat(aspnetcore): add AxiamAccessAttribute with scope + route-param resolution (CONTRACT §11)

Adds the CONTRACT.md §11 declarative authorization helper for the C# SDK:
AxiamAccessAttribute (an AuthorizeAttribute subclass) serializes action/
resource/scope/route-param into a structured policy name that
AxiamPolicyProvider now parses alongside the existing legacy "resource:action"
form. AxiamRequirement carries Scope and ResourceRouteParam through to
AxiamPolicyHandler, which now resolves the resource id from the requirement's
own route-param name (instead of a hardcoded "id") and removes the Guid.Empty
fallback entirely: a missing/non-UUID resource route value is now a 400
invalid_request outcome, and a NetworkError while checking access is a 503
authz_unavailable fail-closed outcome. Both new outcomes are signaled to
AxiamAuthorizationMiddlewareResultHandler via HttpContext.Items (found to be
the only channel reliably shared between the two, since this SDK never
registers an ASP.NET Core authentication scheme).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5foj8NVCeS9qUW94kJ13g

* fix(aspnetcore): map server 403/401 on the check call to 403/503, not 500

AxiamPolicyHandler.HandleRequirementAsync only caught NetworkError, so an
AuthzError (server HTTP 403/409) or AuthError (server HTTP 401) thrown by
CheckAccessAsync propagated unhandled out of the handler and surfaced as a
500 instead of the CONTRACT §11.2.5 mapping. This is reachable on the new
subject_id-override path: openapi.json documents a 403 on /api/v1/authz/check
when the calling service session lacks authz:check_as.

- AuthzError ... (continued)

415 of 480 branches covered (86.46%)

Branch coverage included in aggregate %.

86 of 86 new or added lines in 4 files covered. (100.0%)

997 of 1055 relevant lines covered (94.5%)

15.57 hits per line