Class ScopeRegistry

Namespace

Tharga.Team

Assembly

Tharga.Team.dll

Stores scope definitions and resolves effective scopes for a given access level. Owner and Administrator get all registered scopes. User gets scopes registered at User or Viewer level. Viewer gets only scopes registered at Viewer level. Custom gets no base scopes at all (exempt from the Owner/Administrator all-scopes rule); its effective scopes come solely from roles and scope overrides. Grant-only scopes (RegisterGrantOnly(string, string)) are granted by no access level, Owner and Administrator included; they too are held solely through roles and scope overrides. Role scopes are unioned with access level scopes.

public class ScopeRegistry : IScopeRegistry

Inheritance

object

ScopeRegistry

Implements

IScopeRegistry

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Properties

All

public IReadOnlyList<ScopeDefinition> All { get; }

Property Value

IReadOnlyList<ScopeDefinition>

Methods

GetEffectiveScopes(AccessLevel, IEnumerable<string>, IEnumerable<string>)

public IReadOnlyList<string> GetEffectiveScopes(AccessLevel accessLevel, IEnumerable<string> roleNames, IEnumerable<string> scopeOverrides = null)

Parameters

accessLevel AccessLevel

roleNames IEnumerable<string>

scopeOverrides IEnumerable<string>

Returns

IReadOnlyList<string>

GetScopesForAccessLevel(AccessLevel)

public IReadOnlyList<string> GetScopesForAccessLevel(AccessLevel accessLevel)

Parameters

accessLevel AccessLevel

Returns

IReadOnlyList<string>

Register(string, AccessLevel, string)

public void Register(string scopeName, AccessLevel defaultMinimumLevel, string description = null)

Parameters

scopeName string

defaultMinimumLevel AccessLevel

description string

RegisterGrantOnly(string, string)

Registers a scope that no access level grants. The entry exists for documentation and validation: the scope appears in the catalogue with its description and can be validated against, but it is exempt from the Owner/Administrator all-scopes rule, rejected in tenant-defined custom roles, and not offered by the scope-override pickers.

public void RegisterGrantOnly(string scopeName, string description = null)

Parameters

scopeName string

The scope name, as checked by RequireScopeAttribute.

description string

Human-readable description, shown in the scope catalogue.

Remarks

Use this for a scope that should be held only as a recorded decision — one reaching regulated or classified records, say, where "a team administrator gets it automatically" is the wrong default. Grant it by naming it on a code-registered tenant role (ITenantRoleRegistry) or through an explicit scope override; enforcement via RequireScopeAttribute is unchanged, since the scope is checked from the claim rather than from this registry.

Do not attempt the same thing by registering at Custom. That grants the scope to every level: Owner and Administrator take all registered scopes regardless of the declared minimum, and the fall-through filter DefaultMinimumLevel >= accessLevel is satisfied by Custom for User and Viewer too.

SetRoleRegistry(ITenantRoleRegistry)

public void SetRoleRegistry(ITenantRoleRegistry roleRegistry)

Parameters

roleRegistry ITenantRoleRegistry