Resolve all high-severity architecture review findings

2026-09-09 16:13:58 -04:00
parent 8bfe65512e
commit 146a13238f
192 changed files with 3160 additions and 753 deletions
@@ -12,6 +12,20 @@ namespace ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 /// </summary>
 public static class ClaimsPrincipalExtensions
 {
+    /// <summary>Gets fresh mutation authority, failing closed on a mapping error.</summary>
+    public static Task<AuthenticationState> GetAuthoritativeStateAsync(this AuthenticationStateProvider provider)
+        => provider is CookieAuthenticationStateProvider cookie
+            ? cookie.GetAuthoritativeStateAsync() : provider.GetAuthenticationStateAsync();
+
+    /// <summary>Checks the current grant before invoking a directly audited application service.</summary>
+    public static async Task<string> RequireRoleAsync(this AuthenticationStateProvider provider, string role)
+    {
+        var principal = (await provider.GetAuthoritativeStateAsync()).User;
+        if (principal.Identity?.IsAuthenticated != true || !principal.HasClaim(JwtTokenService.RoleClaimType, role))
+            throw new UnauthorizedAccessException($"The current session requires the {role} role.");
+        return principal.GetUsername();
+    }
+
    /// <summary>Fallback returned when no username claim is present.</summary>
    public const string UnknownUser = "unknown";