Menu
Register shared claims transformation and hierarchical role policies in the API without breaking existing scope enforcement.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Authorization Code Flow for web applications using MSAL.NET confidential client to sign in users and access APIs on their behalf
Handle MSAL distributed token cache collisions and stale entries in ASP.NET Core applications
On-Behalf-Of (OBO) Flow for web APIs to call downstream APIs while preserving user identity in MSAL.NET
{what this skill teaches agents}
Review API DTO implementations for contract/domain separation, mapping patterns, and REST compliance
This skill should be used when the user asks to "build a feature", "fix a bug", "implement something", "start a dev cycle", types "/dev", or describes a software task that requires design, implementation, testing, and shipping. Orchestrates the full software development lifecycle from interrogation through shipping, with self-learning that improves over time.
| name | api-rbac-foundation |
| description | Register shared claims transformation and hierarchical role policies in the API without breaking existing scope enforcement. |
| domain | authentication |
| confidence | high |
| source | earned |
Use this when the API host needs role-based authorization infrastructure before controller actions are migrated away from scope checks.
VerifyUserHasAnyAcceptedScope(...) calls yet.AddBroadcastingApiAuthorization()) so Program.cs stays thin and tests can verify the real registration path.IClaimsTransformation to the shared JosephGuadagno.Broadcasting.Managers.EntraClaimsTransformation implementation rather than duplicating claims logic in the API host.Properties/AssemblyInfo.cs so the test project can verify the real extension method instead of recreating the setup.RequireSiteAdministrator → Site AdministratorRequireAdministrator → Site Administrator, AdministratorRequireContributor → Site Administrator, Administrator, ContributorRequireViewer → Site Administrator, Administrator, Contributor, ViewerIClaimsTransformation from API DI, transforms an authenticated principal, confirms role claims are added, and confirms the original scp claim is still present.src\JosephGuadagno.Broadcasting.Api\Program.cssrc\JosephGuadagno.Broadcasting.Api\Infrastructure\ApiAuthorizationServiceCollectionExtensions.cssrc\JosephGuadagno.Broadcasting.Api.Tests\Infrastructure\ApiAuthorizationServiceCollectionExtensionsTests.csEntraClaimsTransformation inside the API host.