Class TeamContextMiddleware

Namespace

Tharga.Team.Service

Assembly

Tharga.Team.Service.dll

Reads the team header and, when a system caller names a team it may act on, adds the claims for it.

public sealed class TeamContextMiddleware

Inheritance

object

TeamContextMiddleware

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Claims rather than an ambient value, so nothing downstream has to know this exists. Every authorization path in the toolkit — ScopeProxy, [RequireScope], TeamScopePolicy — reads the principal. Adding TeamKey and Scope claims for the named team means a host's own controllers are covered without a line of per-endpoint work, and REST and MCP agree by construction rather than by being kept in step.

A contradiction — a team-bound credential naming a different team — is refused with 403 here rather than left to a later check. The request has already said two incompatible things, and the earliest honest answer is the best one.

Naming a team replaces the team claims; it never adds a second team. A signed-in person already carries claims for the team they selected, and naming a different one is re-selection. The claims for the selected team are removed before the named team's are added, so the principal describes one team, as it does on MCP. Naming the team the caller is already anchored to changes nothing.

Constructors

TeamContextMiddleware(RequestDelegate, IOptions<TeamContextOptions>)

Reads the team header and, when a system caller names a team it may act on, adds the claims for it.

public TeamContextMiddleware(RequestDelegate next, IOptions<TeamContextOptions> options)

Parameters

next RequestDelegate

options IOptions<TeamContextOptions>

Remarks

Claims rather than an ambient value, so nothing downstream has to know this exists. Every authorization path in the toolkit — ScopeProxy, [RequireScope], TeamScopePolicy — reads the principal. Adding TeamKey and Scope claims for the named team means a host's own controllers are covered without a line of per-endpoint work, and REST and MCP agree by construction rather than by being kept in step.

A contradiction — a team-bound credential naming a different team — is refused with 403 here rather than left to a later check. The request has already said two incompatible things, and the earliest honest answer is the best one.

Naming a team replaces the team claims; it never adds a second team. A signed-in person already carries claims for the team they selected, and naming a different one is re-selection. The claims for the selected team are removed before the named team's are added, so the principal describes one team, as it does on MCP. Naming the team the caller is already anchored to changes nothing.

Methods

InvokeAsync(HttpContext, TeamContextResolver)

public Task InvokeAsync(HttpContext context, TeamContextResolver resolver)

Parameters

context HttpContext

resolver TeamContextResolver

Returns

Task