Namespace Tharga.Team

Classes

AllRolesVisibleTenantRoleVisibilityProvider: Default ITenantRoleVisibilityProvider that makes every tenant role visible for every team. Registered unless a consumer supplies its own provider, keeping the visibility hook non-breaking.

ApiKeyLifecycleContext: Information handed to an IApiKeyLifecycleHandler when an API key is created, recycled, or deleted. On Created and Recycled the PrivateToken carries the raw key value — the only moment it is available programmatically. The host is responsible for protecting anything it captures; Tharga Team never persists, logs, or exposes the token elsewhere.

ApiKeyOptions: Configuration options for API key management.

ApiKeyScopes: Scope constants for API key management.

AuditScopes: Scope constants for the audit log.

DefaultIconSource: Built-in IIconSource that resolves a user subject to a configured generic default image (DefaultUserIconUrl), when set. Registered after GravatarIconSource, so it applies when Gravatar is disabled or produced nothing. Returns null when no default is configured (the avatar then falls back to initials).

DirectoryClaimTypes: Claim types carrying the external-directory object id (Microsoft Entra ID's oid), in both the raw JWT form and the .NET-mapped form.

DirectoryUser: A user as known by the external directory (e.g. Microsoft Entra ID).

DirectoryVerificationResult: Result of verifying a local user against the external directory.

DynamicTenantRoleOptions: Options for runtime-defined (dynamic) tenant roles, configured via AddThargaDynamicTenantRoles(IServiceCollection, Action<DynamicTenantRoleOptions>).

GravatarIconSource: Built-in IIconSource that resolves a user subject with an email to its Gravatar image, when enabled via IconSettings. Registered after StoredIconSource and any consumer sources, so an explicitly uploaded user icon (and custom sources) take precedence and Gravatar is a fallback. Returns null for team subjects, users without an email, or when disabled.

IconContent: The bytes and content type of a stored icon, as returned by LoadAsync(string, CancellationToken).

IconImage: A resolved icon image to render — a URL, whether the platform's own serving endpoint or an address a custom IIconSource supplied.

IconInitials: Derives the initials shown as an avatar fallback when no icon image is resolved. One letter for a single word, first+last for multiple; falls back to "?" for an empty name.

IconOptions: Limits applied when accepting an icon (upload or downloaded URL). Configured on the platform options and enforced by IconValidation.

IconResolver: Default IIconResolver: returns the first non-null image from the registered IIconSources, in registration order. The built-in StoredIconSource is registered first, so an explicitly-set (platform-stored) icon takes precedence; consumer sources run after it and fill in only when no icon has been set.

IconRoute: The route the platform serves stored icons from. Shared between the built-in StoredIconSource (which builds the URL) and the hosting layer (which maps the endpoint), so the two never drift.

IconSettings: Runtime-adjustable icon display/behavior settings. Registered as a singleton, so a host can configure initial values at startup (via the platform options) and change them live. Distinct from IconOptions, which holds the upload limits.

IconSubject: The thing an icon is being resolved for, passed to each IIconSource. Carries what a source might key off: the kind and key, a display name (for an initials fallback), any explicitly-set icon reference, and — for user icons (Phase B) — the email and directory id.

IconValidation: Shared size + content-type validation for icons, used by the store and by the operations that accept an upload or a downloaded URL, so the same rules apply on every path.

IconValidationResult: Outcome of validating an icon against IconOptions.

Invitation

InviteModel

InviteUserModel

MemberNameChangedArgs: Arguments for the OnMemberNameChanged callback fired by TeamComponent after a successful inline edit of Name.

NoOpIconProcessor: Default IIconProcessor: returns icon bytes unchanged. Registered by the built-in store so processing is a no-op until a real processor (e.g. the ImageSharp downsizer) is registered.

RequireAccessLevelAttribute: Declares the minimum access level required to call this method.

RequireScopeAttribute: Declares the scope required to call this method.

ResilientMemberLookup: Resilient lookup against in-memory sequences that are expected to contain at most one match but where duplicate rows have been observed in production data (see GitHub issue Tharga/Team#64). Returns the first match and logs a warning when more than one match is present, instead of throwing the way Single<TSource>(IEnumerable<TSource>, Func<TSource, bool>) would. Duplicates are surfaced via ILogger so they can be found and cleaned up out of band.

ScopeDefinition: Defines a scope with its default minimum access level and an optional human-readable description (shown as a tooltip in the scope picker).

ScopeRegistry: Stores scope definitions and resolves effective scopes for a given access level. Owner and Administrator get all registered scopes. User gets scopes registered at User or Viewer level. Viewer gets only scopes registered at Viewer level. Custom gets no base scopes at all (exempt from the Owner/Administrator all-scopes rule); its effective scopes come solely from roles and scope overrides. Role scopes are unioned with access level scopes.

SelectTeamEventArgs

SelectedTeamChangedEventArgs

StoredIconSource: Built-in IIconSource that serves an explicitly-set icon: when the subject has an IconReference, it resolves to that icon's serving-endpoint URL; otherwise null. Registered first, ahead of any consumer sources, so a platform-stored icon takes precedence.

SystemRoleRegistry: Maps app/global role names to system scopes. Role names are matched case-insensitively.

SystemScopeDefinition: Defines a system-level scope (a global capability granted to system API keys and, via role mapping, to privileged users). Unlike team scopes, system scopes have no access-level hierarchy — they are a flat set.

SystemScopeRegistry: Stores system-level scope definitions. A flat set (no access level) — system keys carry an explicit list, and privileged roles map to a subset.

SystemTeamScopes: System-level (cross-team) scope constants for team operations. Unlike the in-team TeamScopes (which authorize only the caller's own team), these authorize across any team and are granted to system API keys or privileged roles. The toolkit defines them; the consumer applies them as they see fit (e.g. o.ConfigureSystemRoles mapping a role to the scope, or a system API key's scope list).

SystemUserScopes: System-level scope constants for user administration. Like SystemTeamScopes, these authorize cross-team operations and are granted to privileged roles or system API keys. The toolkit defines them; the consumer applies them as they see fit (e.g. o.ConfigureSystemRoles mapping a role to the scope).

Tag: A system-set key-value tag on an API key. Tags are a list (not a map), so the same Key may appear more than once (e.g. a combination key tagged with multiple types). Each tag is surfaced as a tag.{Key} claim on the authenticated principal.

TeamClaimTypes: Claim type constants for team-based authorization.

TeamManagementService<TMember>: Delegates to ITeamService for all operations. Scope enforcement is handled by ScopeProxy<T> in Tharga.Team.Service. Generic methods (GetTeamsAsync, DeleteTeamAsync, RenameTeamAsync) call non-generic internal versions since the proxy resolves the member type from the team data.

TeamModel

TeamScopes: Scope constants for team and member management.

TeamServiceBase

TeamsListChangedEventArgs

TenantRoleDefinition: Defines a tenant role with its associated scopes and an optional human-readable description (shown as a tooltip in the role picker, alongside the scopes the role grants).

TenantRoleRegistry: Stores tenant role definitions and resolves scopes for assigned roles.

TenantRoleService: Default ITenantRoleService: merges code-registered roles (ITenantRoleRegistry) with a team's runtime-defined custom roles (read via ITeamService) and unions their scopes on top of the access-level and override scopes resolved by IScopeRegistry. The role registry and scope registry are optional (null when the consumer configured neither).

TenantRoleServiceCollectionExtensions: Extension methods for registering tenant roles.

ThargaTeamRegistration: Vestigial registration entry point that never registered anything.

UserDeleteResult: Result of DeleteUserAsync(string, bool, CancellationToken). The local delete (all team memberships and the user record) has always completed when this is returned — a failure there throws instead.

UserServiceBase

UserVerificationResult: Per-user item in a bulk verification stream (VerifyAllAsync(CancellationToken)).

Interfaces

IApiKey: Represents an API key with associated metadata.

IApiKeyAdministrationService: Service for managing and validating API keys.

IApiKeyLifecycleHandler

Opt-in hook that receives an API key's private token at the moment it exists — on create and on recycle/regenerate — plus a tokenless signal on delete. Register one or more implementations with AddThargaApiKeyLifecycleHandler<T>(); they are invoked after the corresponding operation succeeds.

The token is handed only to in-process code the host explicitly registered. If the handler throws, the originating operation (create/recycle/delete) throws too — capture failures are not swallowed.

IApiKeyManagementService: User-facing management of a team's API keys. Every operation names the team it acts on as its first argument, and requires the Manage scope on that team — holding the scope for one team does not authorize acting on another.

IIconProcessor: Optional pre-processing applied to icon bytes before they are stored — e.g. downscaling an oversized image so it fits the configured limits. The built-in store runs the registered processor before validating/persisting. Register an implementation (e.g. AddThargaImageProcessing from the Tharga.Team.Images package) to enable it; without one, icons are stored as-is.

IIconResolver: Resolves the image to display for a subject by running the registered IIconSources in order and returning the first non-null result. Returns null when no source supplies an image — the caller (e.g. an avatar component) then renders an initials/default fallback via IconInitials. Built-in; consumers customize resolution by registering sources, not by replacing the resolver.

IIconSource: A source of icon images. This is the sourcing seam — where a displayed image comes from, separate from where bytes are stored (IIconStore). The platform runs the built-in StoredIconSource first (an explicitly-set icon wins), then the registered sources (via o.AddIconSource<T>()) in order, so a consuming system can supply icons for subjects that have no platform-stored icon — returning null to defer to the next source.

IIconStore: Pluggable storage for icon bytes. The built-in default (MongoIconStore in Tharga.Team.MongoDB) stores icons in the database; a consuming system can replace it via o.AddIconStore<T>() to store elsewhere (Azure Blob, S3, an existing DMS, …). This is the storage seam — where bytes live; where a displayed image is sourced from is the separate IIconSource seam.

IScopeRegistry: Registry of all known scopes. Used at runtime to resolve effective scopes for an access level.

ISystemApiKeyManagementService: User-facing management of system API keys — keys not bound to any team. All methods require the SystemManage scope and no team need be selected.

ISystemRoleRegistry: Maps app/global roles (e.g. "Developer", "Administrator") to system-level scopes, so privileged users gain those scopes as claims — the user-side counterpart to a system API key's explicit scope list.

ISystemScopeRegistry: Registry of system-level (global) scopes — the capabilities a system API key (or a privileged role) may hold. Separate from the team IScopeRegistry, which is access-level based and team-scoped.

ITeam

ITeamClaimsEnricher: Implement to inject custom claims (e.g. global roles) before team consent evaluation. Register via AddClaimsEnricher<T>() on ThargaBlazorOptions. Called once per request inside TeamServerClaimsTransformation, before member lookup and consent check.

ITeamEmailSender: Abstraction for sending team-related emails. Consumers can implement this to use their own email infrastructure (SendGrid, Azure, etc.). When not registered, invite dialogs fall back to manual link copying.

ITeamLifecycleService: Team lifecycle operations that precede a team existing, and so cannot be authorized against one.

ITeamManagementService: Team management mutations. Authorization is enforced in the service layer by AuthorizationTeamServiceDecorator (over ITeamService); the [RequireScope] attributes here document the scope each operation requires. Read operations use ITeamService directly.

ITeamMember

ITeamService

ITeam<TMember>

ITenantRoleRegistry: Registry of tenant role definitions. Used at runtime to resolve scopes for assigned roles.

ITenantRoleService: Team-aware view over tenant roles: composes the global code-registered roles (ITenantRoleRegistry) with a team's runtime-defined custom roles, and resolves the effective scopes for a member of a specific team. This is the resolution path that lets a member assigned a custom role receive that role's scopes — the team-blind ITenantRoleRegistry only knows code roles.

ITenantRoleVisibilityProvider: Decides whether a given tenant role should be offered in the role editor for a given team. Consulted by the team role editor before building its per-team role list, letting a consumer hide feature-gated roles from teams where the feature is disabled.

IUser

IUserDirectoryService: Pluggable connection to an external user directory (e.g. Microsoft Entra ID). Optional — registered via AddUserDirectoryService<T>() on the platform options; when not registered, directory features (verify, directory-only listing, directory delete) are unavailable and their UI is hidden.

IUserManagementService: User administration operations: directory verification and user deletion. Authorization is enforced in the service layer by an authorization decorator; the [RequireScope] attributes here document the scope each operation requires. All operations require the Manage system scope. Directory-backed operations require a registered IUserDirectoryService.

IUserService: The user store. Authorization is enforced in the service layer by AuthorizationUserServiceDecorator: resolving the current user and the invitation-accept name seeding are self-service; setting a display name is allowed on the caller's own record (otherwise users:manage); the [RequireScope]-annotated members document the scope they require.

Enums

AccessLevel

ApiKeyLifecycleReason: Why an IApiKeyLifecycleHandler is being invoked.

DirectoryUserStatus: Outcome of verifying a local user against the external directory (VerifyUserAsync(IUser, CancellationToken)).

IconKind: What an icon belongs to. Lets a single IIconStore / IIconSource serve both teams and users.

MembershipState

PrivateKeyScope: Controls which owner-scoped ("private") API keys a listing includes, on top of the normal team-wide keys. The actual entitlement is always intersected with the caller's identity, so these values can never reveal a key the caller isn't allowed to see.

Table of Contents

Namespace Tharga.Team

Classes

Interfaces

Enums