Class TeamClaimTypes

Namespace

Tharga.Team

Assembly

Tharga.Team.dll

Claim type constants for team-based authorization.

public static class TeamClaimTypes

Inheritance

object

TeamClaimTypes

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Fields

AccessLevel

Claim type for the access level.

public const string AccessLevel = "AccessLevel"

Field Value

string

ApiKeyId

Claim type carrying the stable identifier of the API key used to authenticate (the IApiKey.Key Guid string).

public const string ApiKeyId = "ApiKeyId"

Field Value

string

IsSystemKey

Claim type that marks a principal as authenticated via a system API key (not bound to a team). Value: "true".

public const string IsSystemKey = "IsSystemKey"

Field Value

string

MemberKey

Claim type carrying the caller's team-member key (ITeamMember.Key) for the selected team. Used to scope owner-private API keys.

public const string MemberKey = "MemberKey"

Field Value

string

Scope

Claim type for scopes granted by the caller's access level, roles or overrides on the selected team. Multiple scope claims may be present.

public const string Scope = "Scope"

Field Value

string

Remarks

A scope here authorizes the selected team only. System-wide grants use SystemScope — the two are separate claim types so that a grant's origin survives into the claim. Emitting both as one type meant a system role silently satisfied a check that asked for the scope on a specific team.

SelectedTeamKey

Claim type marking which team the caller currently has selected, independent of whether that selection grants any access.

public const string SelectedTeamKey = "team_id"

Field Value

string

Remarks

Emitted from the selected-team cookie before access is resolved, so it is present even when TeamKey is not. Consult it to tell "no team is selected" apart from "a team is selected that the caller cannot reach" — keying only off TeamKey conflates the two.

SystemScope

Claim type for scopes granted system-wide — from an app role via ConfigureSystemRoles, or from a system API key. Not bound to any team. Multiple claims may be present.

public const string SystemScope = "SystemScope"

Field Value

string

TagPrefix

Prefix for per-tag claims emitted from an API key's Tags. A tag with key K becomes a claim of type tag.K. Multiple claims with the same type may be present.

public const string TagPrefix = "tag."

Field Value

string

TeamKey

Claim type for the team key.

public const string TeamKey = "TeamKey"

Field Value

string

Remarks

This is the access anchor: it is emitted only once access to the team has resolved, so its presence means "the caller may act on this team". It is not a record of what the caller picked — that is SelectedTeamKey. The two differ whenever a team is selected but grants the caller nothing.