菜单
Apply project authentication and authorization rules for BFF token handling, JWT validation, claim extraction, and handler-level access checks.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run the canonical build plus all nine per-project test commands from docs/TESTING.md. Never uses solution-level dotnet test.
Create or re-baseline lean, repository-grounded implementation plans and persistent dev docs when users ask for an implementation plan, technical plan, feature plan, refactor plan, or dev-docs workstream.
Senior CTO review workflow for repository-grounded implementation-plan workstreams used before coding.
Apply project EF Core conventions for repositories, DbContext setup, query filters, migrations, and seeded lookup data.
Create a self-contained HTML artifact focused on a high-quality SVG architecture or system diagram with minimal supporting prose.
Create a pragmatic self-contained HTML plan that organizes the user's plan content visually without expanding the scope unnecessarily.
| name | auth-patterns |
| description | Apply project authentication and authorization rules for BFF token handling, JWT validation, claim extraction, and handler-level access checks. |
| type | pattern |
| enforcement | suggest |
| priority | critical |
Use this skill for browser-to-BFF-to-API authentication flow, endpoint protection defaults, claim extraction, and resource authorization behavior. It keeps security logic consistent across controllers, handlers, and HAL-driven clients.
*Controller.cs, *Program.cs, **/Authorization/**/*.cs, Explore.API/**/*.cs, Explore.Blazor/**/*.cs.add-write-endpoint, add-get-endpoint, add-hal-link, blazor-component-affordance.Bearer token to the API.sub then nameidentifier then sid, and a missing user identifier yields 401 Unauthorized.aud and azp with a five-minute clock skew, and authorized audiences include islamu-event-api and islamu-event-blazor.GET with [AllowAnonymous], writes with [Authorize], and admin operations with [Authorize(Roles = "Admin")], while ownership checks stay in handlers through IAuthorizedRequest, [AuthorizeResource], or ISecureRequest._links the only client-side source of truth for action gating.localStorage or sessionStorage bypasses the BFF boundary and weakens browser-side security._links drifts from the server authorization contract.Tenant query filter during runtime request handling creates cross-tenant authorization and data-isolation bugs.aud or only azp allows unauthorized clients to present otherwise valid tokens.public static class ClaimsPrincipalExtensions
{
public static string GetRequiredUserId(this ClaimsPrincipal user)
{
string? userId = user.FindFirstValue("sub")
?? user.FindFirstValue(ClaimTypes.NameIdentifier)
?? user.FindFirstValue("sid");
return string.IsNullOrWhiteSpace(userId)
? throw new UnauthorizedAccessException("Missing user id claim.")
: userId;
}
}
public sealed record UpdateEventCommand(Guid EventId, string Title)
: IAuthorizedRequest<BaseCommandResponse<Guid>>;
public sealed class UpdateEventHandler(IEventRepository repository)
{
public async Task<BaseCommandResponse<Guid>> Handle(
UpdateEventCommand request,
CancellationToken cancellationToken)
{
Event entity = await repository.GetRequiredAsync(request.EventId, cancellationToken);
entity.Rename(request.Title);
await repository.UpdateAsync(entity, cancellationToken);
return new BaseCommandResponse<Guid>(entity.Id, true, "Updated");
}
}
dotnet test --project Event.Architecture.Tests/Event.Architecture.Tests.csproj --configuration Release --verbosity quiet --filter FullyQualifiedName~Event.Architecture.Tests.AuthorizationParityTestsdotnet test --project Event.API.IntegrationTests/Event.API.IntegrationTests.csproj --configuration Release --verbosity quietdotnet build --configuration Release --verbosity quiet