メニュー
Register shared claims transformation and hierarchical role policies in the API without breaking existing scope enforcement.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Authorization Code Flow for web applications using MSAL.NET confidential client to sign in users and access APIs on their behalf
Handle MSAL distributed token cache collisions and stale entries in ASP.NET Core applications
On-Behalf-Of (OBO) Flow for web APIs to call downstream APIs while preserving user identity in MSAL.NET
{what this skill teaches agents}
Review API DTO implementations for contract/domain separation, mapping patterns, and REST compliance
This skill should be used when the user asks to "build a feature", "fix a bug", "implement something", "start a dev cycle", types "/dev", or describes a software task that requires design, implementation, testing, and shipping. Orchestrates the full software development lifecycle from interrogation through shipping, with self-learning that improves over time.
| name | api-rbac-foundation |
| description | Register shared claims transformation and hierarchical role policies in the API without breaking existing scope enforcement. |
| domain | authentication |
| confidence | high |
| source | earned |
Use this when the API host needs role-based authorization infrastructure before controller actions are migrated away from scope checks.
VerifyUserHasAnyAcceptedScope(...) calls yet.AddBroadcastingApiAuthorization()) so Program.cs stays thin and tests can verify the real registration path.IClaimsTransformation to the shared JosephGuadagno.Broadcasting.Managers.EntraClaimsTransformation implementation rather than duplicating claims logic in the API host.Properties/AssemblyInfo.cs so the test project can verify the real extension method instead of recreating the setup.RequireSiteAdministrator → Site AdministratorRequireAdministrator → Site Administrator, AdministratorRequireContributor → Site Administrator, Administrator, ContributorRequireViewer → Site Administrator, Administrator, Contributor, ViewerIClaimsTransformation from API DI, transforms an authenticated principal, confirms role claims are added, and confirms the original scp claim is still present.src\JosephGuadagno.Broadcasting.Api\Program.cssrc\JosephGuadagno.Broadcasting.Api\Infrastructure\ApiAuthorizationServiceCollectionExtensions.cssrc\JosephGuadagno.Broadcasting.Api.Tests\Infrastructure\ApiAuthorizationServiceCollectionExtensionsTests.csEntraClaimsTransformation inside the API host.