Class TeamAccess

Namespace

Tharga.Team.Service

Assembly

Tharga.Team.Service.dll

Ambient record of the authorization decision covering the current call flow, read by TeamAccessInterceptor at the database boundary.

public static class TeamAccess

Inheritance

object

TeamAccess

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The authorization layer opens a scope for you, so a correctly registered service never touches this type. It exists for the deliberate exceptions — work that legitimately reaches the database without a caller to authorize, such as startup seeding or a background job — which must say so explicitly:

using var _ = TeamAccess.System("nightly audit retention");

A reason is required on those paths precisely so the escape hatch stays greppable and reviewable.

Backed by AsyncLocal<T> rather than a DI-scoped service: in Blazor Server a DI scope is the circuit's lifetime, not the operation's, so a scoped holder would keep one team's authorization alive across the whole circuit and go stale the moment the user switched team. An AsyncLocal<T> flows down through awaits into the work it covers and is restored when the scope disposes, which matches the shape of an authorization decision.

Properties

Current

The decision covering the current call flow, or null when nothing has authorized it.

public static TeamAccessContext Current { get; }

Property Value

TeamAccessContext

Methods

ForTeam(string)

Records that the caller was authorized against teamKey.

public static IDisposable ForTeam(string teamKey)

Parameters

teamKey string

Returns

IDisposable

System(string)

Records that the caller holds a system scope, spanning no particular team.

public static IDisposable System(string reason)

Parameters

reason string

Returns

IDisposable

Unchecked(string)

Declares that this call flow deliberately reaches the database without an authorization check. For work with no caller to authorize — seeding, migrations, background jobs.

public static IDisposable Unchecked(string reason)

Parameters

reason string

Returns

IDisposable