Namespace Tharga.Team

AllRolesVisibleTenantRoleVisibilityProvider

Default ITenantRoleVisibilityProvider that makes every tenant role visible for every team. Registered unless a consumer supplies its own provider, keeping the visibility hook non-breaking.

AllScopesVisibleTeamScopeVisibilityProvider

Default ITeamScopeVisibilityProvider that makes every scope visible for every team. Registered unless a consumer supplies its own provider, keeping the visibility hook non-breaking.

ApiKeyLifecycleContext

Information handed to an IApiKeyLifecycleHandler when an API key is created, recycled, or deleted. On Created and Recycled the PrivateToken carries the raw key value — the only moment it is available programmatically. The host is responsible for protecting anything it captures; Tharga Team never persists, logs, or exposes the token elsewhere.

ApiKeyOptions

Configuration options for API key management.

ApiKeyScopes

Scope constants for API key management.

AuditScopes

Scope constants for the audit log.

CallerTeamAccess

The caller's own access to one team.

CircuitPrincipal

Reads the caller from an AuthenticationStateProvider without assuming there is a circuit to read from.

ConsentInForce

The consent a team has in force at a moment.

ConsentOptions

Data-access consent options — controls cross-team access granted by a team to global roles.

ContactAddressee

One person the host lists as an addressee of a message to contacts: an address, and what the host knows of them.

ContactAddresseeCheck

One distinct address of a list, and whether it will be mailed.

ContactAddresseeList

A list checked before sending: each distinct address in the order first listed, with the counts.

ContactMailCategory

A kind of mail the product's staff send to contacts — people who are not users, such as prospective customers — which each address may opt out of.

ContactMailSuppression

An address that asked not to receive contact mail: of one category, or of any contact mail from the product.

ContactMailTexts

The keys and English defaults of the text contact mail carries outside a component: its footer and its unsubscribe page.

ContactMessage

A message to write to contacts, as handed to SendAsync(ContactMessage, CancellationToken).

ContactMessageChoices

What a message to contacts may be written in and the limits it is held to.

ContactMessageLogEntry

A message to contacts as the log records it when it is sent.

ContactMessageLogPage

One page of recorded messages to contacts.

ContactMessageRecipient

One address of a message to contacts and what became of the mail to it.

ContactMessageRecipientPage

One page of a message's addresses: those queued in the order they were, then those never queued.

DefaultIconSource

Built-in IIconSource that resolves a user subject to a configured generic default image (DefaultUserIconUrl), when set. Registered after GravatarIconSource, so it applies when Gravatar is disabled or produced nothing. Returns null when no default is configured (the avatar then falls back to initials).

DirectoryClaimTypes

Claim types carrying the external-directory object id (Microsoft Entra ID's oid), in both the raw JWT form and the .NET-mapped form.

DirectoryNames

Rules for comparing a local user's name with the display name an external directory holds.

DirectoryUser

A user as known by the external directory (e.g. Microsoft Entra ID).

DirectoryUserIdentities

The sign-in identities the directory holds for one directory user, as returned by GetIdentitiesByIdsAsync(IEnumerable<string>, CancellationToken).

DirectoryUserIdentity

One way a directory user signs in (for Entra: an entry of the Graph identities collection).

DirectoryVerificationResult

Result of verifying a local user against the external directory.

DynamicTenantRoleOptions

Options for runtime-defined (dynamic) tenant roles, configured via AddThargaDynamicTenantRoles(IServiceCollection, Action<DynamicTenantRoleOptions>).

ExternalSupportContact

Who wrote to support through a public form: a person nobody has signed in or verified.

GravatarIconSource

Built-in IIconSource that resolves a user subject with an email to its Gravatar image, when enabled via IconSettings. Registered after StoredIconSource and any consumer sources, so an explicitly uploaded user icon (and custom sources) take precedence and Gravatar is a fallback. Returns null for team subjects, users without an email, or when disabled.

GravatarStyles

The Gravatar default-image styles, which is what GravatarStyle holds.

IconCapability

Whether the icon feature can actually do what a surface is about to promise.

IconContent

The bytes and content type of a stored icon, as returned by LoadAsync(string, CancellationToken).

IconImage

A resolved icon image to render — a URL, whether the platform's own serving endpoint or an address a custom IIconSource supplied.

IconInitials

Derives the initials shown as an avatar fallback when no icon image is resolved. One letter for a single word, first+last for multiple; falls back to "?" for an empty name.

IconOptions

Limits applied when accepting an icon (upload or downloaded URL). Configured on the platform options and enforced by IconValidation.

IconResolver

Default IIconResolver: returns the first non-null image from the registered IIconSources, in registration order. The built-in StoredIconSource is registered first, so an explicitly-set (platform-stored) icon takes precedence; consumer sources run after it and fill in only when no icon has been set.

IconRoute

The route the platform serves stored icons from. Shared between the built-in StoredIconSource (which builds the URL) and the hosting layer (which maps the endpoint), so the two never drift.

IconSettings

Runtime-adjustable icon display/behavior settings. Registered as a singleton, so a host can configure initial values at startup (via the platform options) and change them live. Distinct from IconOptions, which holds the upload limits.

IconSettingsService

The built-in IIconSettingsService: the live singleton is the read, the store is the record.

IconSettingsState

The stored form of IconSettings — the values a site can change, without the behaviour.

IconSubject

The thing an icon is being resolved for, passed to each IIconSource. Carries what a source might key off: the kind and key, a display name (for an initials fallback), any explicitly-set icon reference, and — for user icons (Phase B) — the email and directory id.

IconValidation

Shared size + content-type validation for icons, used by the store and by the operations that accept an upload or a downloaded URL, so the same rules apply on every path.

IconValidationResult

Outcome of validating an icon against IconOptions.

InMemoryTeamCache

The built-in ITeamCache: entries held in this process, with no expiry, dropped only when a write invalidates them. Registered as a singleton by the toolkit unless a host registered its own.

InboundMailItem

One received mail, as a team's mailbox or the postmaster holds it.

InboundMailPage

A page of a team's mail, with an explicit cursor for the next one.

Invitation

InvitationOptions

Invitation policy — how long an invitation stays acceptable.

InvitationPolicy

When an invitation expires. The single copy of that rule.

InviteModel

InviteToken

Generates the code that authorizes accepting an invitation.

InviteUserModel

MailContent

A received mail as it arrived: the raw MIME message, with its body and attachments.

MailEnvelope

What a received mail says about itself, without its body or attachments.

MailPreview

A mail as its recipient would receive it, rendered from a draft without sending or storing anything.

MailThreadOwner

What a mail belongs to, in the host's terms — a support case, a case in a register — named by a type and an id the toolkit does not interpret.

MailboxScopes

Team scope constants for a team's mailbox.

MemberNameChangedArgs

Arguments for the OnMemberNameChanged callback fired by TeamComponent after a successful inline edit of Name.

NoOpIconProcessor

Default IIconProcessor: returns icon bytes unchanged. Registered by the built-in store so processing is a no-op until a real processor (e.g. the Tharga.Team.Images downsizer) is registered.

NoticeScopes

Team scope constants for automatic notices.

PostmasterMailOutcome

The Outcome the postmaster records on mail it holds.

PostmasterMailSummary

An unrouted mail as the postmaster lists it: who sent it, about what and when, and nothing more until it is opened.

PostmasterPage

A page of unrouted mail, with an explicit cursor for the next one; NextCursor is null on the last page.

ReceivedMailBody

A received mail made readable: its text, its formatting made safe, the images it shows in place and the files it carries.

ReceivedMailImage

An image a received mail shows inside its text, carried with the text so a reader sees it in place.

RequireAccessLevelAttribute

Declares the minimum access level required to call this method.

RequireScopeAttribute

Declares the scope required to call this method.

ResilientMemberLookup

Resilient lookup against in-memory sequences that are expected to contain at most one match but where duplicate rows have been observed in production data (see GitHub issue Tharga/Team#64). Returns the first match and logs a warning when more than one match is present, instead of throwing the way Single<TSource>(IEnumerable<TSource>, Func<TSource, bool>) would. Duplicates are surfaced via ILogger so they can be found and cleaned up out of band.

ScopeDefinition

Defines a scope with its default minimum access level and an optional human-readable description (shown as a tooltip in the scope picker).

ScopeGroup

A host-defined area that scopes are shown under, such as a product area. Defined with DefineGroup(string, string); the order groups are defined in is the order they are shown in.

ScopeRegistry

Stores scope definitions and resolves effective scopes for a given access level. Owner and Administrator get all registered scopes. User gets scopes registered at User or Viewer level. Viewer gets only scopes registered at Viewer level. Custom gets no base scopes at all (exempt from the Owner/Administrator all-scopes rule); its effective scopes come solely from roles and scope overrides. Grant-only scopes (RegisterGrantOnly(string, string)) are granted by no access level, Owner and Administrator included; they too are held solely through roles and scope overrides. Role scopes are unioned with access level scopes.

SelectTeamEventArgs

SelectedTeamChangedEventArgs

The selection a SelectedTeamChangedEvent is reporting.

SentContactMessage

A message to contacts as the log keeps it: what it was, who sent it in which category, and what became of each mail.

SentContactMessagePage

One page of the log of messages to contacts, newest first.

SentUserMessage

A message as the sent log keeps it: what it was, who sent it to which selection, and what became of each mail.

SentUserMessagePage

One page of the sent log, newest first.

SetOwnerResult

What a set-owner did: whether it changed anything, and which owners it displaced.

StoredIconSource

Built-in IIconSource that serves an explicitly-set icon: when the subject has an IconReference, it resolves to that icon's serving-endpoint URL; otherwise null. Registered first, ahead of any consumer sources, so a platform-stored icon takes precedence.

StoredSupportAiConnection

A team's AI connection as stored: the key only as Data Protection protected it.

SupportAiConnection

A team's AI connection as it may be shown: everything but the key.

SupportAiConnectionChoices

What a team may choose here, and where each provider starts.

SupportAiConnectionResult

The outcome of connecting to or testing a provider.

SupportAiModel

A model a provider offers.

SupportAiModelList

The models a provider offers, or why they could not be listed.

SupportAiProviderDefault

The address a provider kind starts from, and whether it needs a key.

SupportAiProviderRequest

A provider connection to check, list the models of, or save.

SupportAnswer

What an assistant had to say about a case.

SupportAnswerRoute

Where support's answer to a case goes: mailed to the address the case corresponds with, from one of support's mailboxes, or shown on the site.

SupportAssistantCall

One service call the assistant made while answering: the tool, and what it was asked for.

SupportAssistantProgress

How far the assistant has got with an answer: the text so far, which call to the model it is on, and the service calls it has made.

SupportAssistantUsage

The tokens a model reported for one of the assistant's answers, every round of its tool loop added up.

SupportAssistantUsageRecord

One time the support assistant was asked: who asked, in which case, which model answered, and what it took.

SupportAssistantUsageTotal

What one team used of one model in a period.

SupportAttachment

A file carried by a support message, described by its sanitized name, declared type and size; the content is kept by Tharga.Team.ISupportAttachmentStore.

SupportAttachmentContent

An opened attachment: its metadata and a stream over its content, which the caller disposes.

SupportAttachmentContentTypes

Which attachments may open in the browser — only types shown without running script, since a file opened from the application runs in its origin — and what every other one is served as.

SupportAttachmentLimits

How many files, and how large, one support message may carry, applied the same way in and out.

SupportAttachmentUpload

A file to attach to a support message, read once from Content, which the caller disposes after the call.

SupportCase

A support conversation belonging to a team.

SupportCaseActors

Identities the toolkit itself acts under on a support case.

SupportCaseLimits

What bounds a support case, so an embedded transcript cannot grow without limit.

SupportCasePage

A page of support cases, with an explicit cursor for the next one.

SupportCaseTeam

A team named on a support case — its key, and its name as it was when it was recorded.

SupportCaseTypingEventArgs

Somebody is writing in a support case and has not sent it yet.

SupportCaseUnread

How many entries in one of the caller's own cases they have not read.

SupportCaseUpdatedEventArgs

Something happened to a support case.

SupportCaseVisibilityChoice

What the caller may choose about who reads a case: whether they may change it, and whether only they may read it.

SupportCaseVisibilityRules

Who may keep a support case to themselves.

SupportChannelBinding

A projection of a support case onto an external system — a Slack thread, an email thread.

SupportChannelPostResult

What became of posting one message into a channel.

SupportMailTexts

The keys and English defaults of the text a support answer mail carries: who wrote each earlier entry it quotes.

SupportMessage

One entry in a support case's transcript.

SupportMessagePage

A page of a support case's transcript, with an explicit cursor for the next one.

SupportSender

A user account holding a support mail's sender address, and the teams it is an active member of.

SystemApiKeyScopes

System-level scope constants for API keys. Like SystemUserScopes, these are granted to privileged roles (e.g. through o.ConfigureSystemRoles) rather than held through a team.

SystemContactScopes

System scope constants for mail the product's staff write to contacts: people who are not users, whose addresses the host holds in its own records.

SystemMailboxScopes

System scope constants for the postmaster: mail that reached the shared mailbox but belongs to no team.

SystemMessageScopes

System scope constants for messages written by the product's staff to users of its teams.

SystemRoleRegistry

Maps app/global role names to system scopes. Role names are matched case-insensitively.

SystemScopeDefinition

Defines a system-level scope (a global capability granted to system API keys and, via role mapping, to privileged users). Unlike team scopes, system scopes have no access-level hierarchy — they are a flat set.

SystemScopeRegistry

Stores system-level scope definitions. A flat set (no access level) — system keys carry an explicit list, and privileged roles map to a subset.

SystemSupportScopes

System-level scope constants for support cases: the unassigned queue, and reading or answering across every team.

SystemTeamScopes

System-level (cross-team) scope constants for team operations. Unlike the in-team TeamScopes (which authorize only the caller's own team), these authorize across any team and are granted to system API keys or privileged roles. The toolkit defines them; the consumer applies them as they see fit (e.g. o.ConfigureSystemRoles mapping a role to the scope, or a system API key's scope list).

SystemUserScopes

System-level scope constants for user administration. Like SystemTeamScopes, these authorize cross-team operations and are granted to privileged roles or system API keys. The toolkit defines them; the consumer applies them as they see fit (e.g. o.ConfigureSystemRoles mapping a role to the scope).

Tag

A system-set key-value tag on an API key. Tags are a list (not a map), so the same Key may appear more than once (e.g. a combination key tagged with multiple types). Each tag is surfaced as a tag.{Key} claim on the authenticated principal.

TeamAccessRequest

A request, by someone holding a consent role, for access to a team they are not a member of.

TeamAccessRequestItem

An access request together with the team it is for.

TeamAccessRequestRules

The fixed rules for team access requests.

TeamCacheWiring

Whether the services a host registered are actually using the ITeamCache the container resolves — the one way the cache seam can be configured and silently not take effect.

TeamClaimTypes

Claim type constants for team-based authorization.

TeamConsent

The one rule for which consent a team has in force. Every consent read goes through it.

TeamInvitation

What an invite code resolves to. Everything an invitation screen needs, and nothing more.

TeamInviteMail

Everything an ITeamEmailSender is given to write one invitation.

TeamMailAddresses

A team's mail keys: at most one primary and one secondary.

TeamMailKey

One of a team's mail keys, and the address it makes.

TeamMailKeyRecord

A team's mail key as it is kept, retired keys included, so mail to a retired key is known to be retired rather than unknown.

TeamMailUpdatedEventArgs

Something happened to a received mail: enough to update a counter or re-read one mail, deliberately not its content.

TeamManagementService<TMember>

Delegates to Tharga.Team.ITeamService for all operations, enforcing team:read on the reads.

Mutations are enforced downstream, by AuthorizationTeamServiceDecorator over Tharga.Team.ITeamService. Reads are enforced here, because that decorator deliberately does not gate reads: the claims pipeline reads team data while building the principal, so a gate there would be circular and break sign-in.

The [RequireScope] attributes on ITeamManagementService are documentation. They would be enforced by ScopeProxy<T> if this were registered through AddTeamService, and it is not — so nothing derives from them at runtime. Do not add a read to this class and assume the attribute covers it: ScopeEnforcementProofTests fails for any attributed method that lets a caller holding nothing through.

Generic methods (GetTeamsAsync, DeleteTeamAsync, RenameTeamAsync) call non-generic internal versions since the proxy resolves the member type from the team data.

TeamMemberTypeResolver

Works out which ITeamMember type a team service is built around, when the host did not say so explicitly.

TeamModel

TeamOwnership

Decides who may be made the owner of a team, and which sitting owners that displaces.

TeamScopes

Scope constants for team and member management.

TeamServiceBase

TeamServiceCompleteness

Finds storage extension points a host has left un-overridden while granting what reaches them.

TeamServiceFacets

The interfaces a caller injects to reach a team, all implemented by one object.

TeamServiceGap

A storage extension point on TeamServiceBase that a host can reach without having implemented it.

TeamStorageException

A team's underlying storage could not be removed. Carries the team key and the store's own failure as InnerException.

TeamsListChangedEventArgs

TemporaryConsent

A consent that runs out, and what the team's consent returns to when it does.

TenantRoleDefinition

Defines a tenant role with its associated scopes and an optional human-readable description (shown as a tooltip in the role picker, alongside the scopes the role grants).

TenantRoleRegistry

Stores tenant role definitions and resolves scopes for assigned roles.

TenantRoleService

Default ITenantRoleService: merges code-registered roles (ITenantRoleRegistry) with a team's runtime-defined custom roles (read via Tharga.Team.ITeamService) and unions their scopes on top of the access-level and override scopes resolved by IScopeRegistry. The role registry and scope registry are optional (null when the consumer configured neither).

TenantRoleServiceCollectionExtensions

Extension methods for registering tenant roles.

UserCreatedEventArgs

The user record created on someone's first sign-in, and the principal it was created from.

UserDeleteResult

Result of DeleteUserAsync(string, bool, CancellationToken). The local delete (all team memberships and the user record) has always completed when this is returned — a failure there throws instead.

UserEmailChangeResult

Result of SetUserEmailAsync(string, string, CancellationToken).

UserIdentityResolver

The one place a principal is turned into the identity a user is stored and audited under.

UserMail

A mail to one user, in one category, as it is handed to Tharga.Team.IUserMailQueue.

UserMailAttachment

A file sent with a UserMail.

UserMailBatch

One mail to many users, handed to QueueBatchAsync(UserMailBatch, CancellationToken), whose content and files are stored once however many it goes to.

UserMailBatchAddress

An address one mail of a batch goes to alone, and the name it is addressed to.

UserMailBatchDelivery

What became of a queued batch.

UserMailBatchQueued

The outcome of QueueBatchAsync(UserMailBatch, CancellationToken).

UserMailBounceResult

What a bounce report did to the mail it names.

UserMailCategories

The two built-in categories every host has, so mail the toolkit itself sends always has a category to go in.

UserMailCategory

A kind of mail the product sends its users, which each user may turn off unless it is required.

UserMailCategoryFrequency

How often one category of mail was sent, per user who received it, over the period the outbox can still count.

UserMailCategorySent

How many mails in one category an outbox sent to users since a time, and to how many users; for a contact category, to how many addresses.

UserMailChoice

Whether one user receives one category, and whether that is their own choice or the category's default.

UserMailDelivery

What became of one queued mail.

UserMailDeliveryPage

One page of queued mail and what became of each.

UserMailFailure

Why the mail to one recipient of a batch was given up.

UserMailFilter

Which mail the global mail log lists. Every part given narrows the list further; with none given it lists all mail.

UserMailFrequencyPhrase

The words for how often a category is sent: which text, by its key and English default, and the number it holds.

UserMailHistoryItem

One mail in a user's history.

UserMailHistoryPage

One page of a user's mail history, newest first.

UserMailItem

A mail as the outbox keeps it: what was queued and where it stands.

UserMailItemPage

One page of stored mail.

UserMailOutcomes

How many mails of a batch stand where.

UserMailQueued

The outcome of QueueAsync(UserMail, CancellationToken).

UserMailRecipient

Who a user mail goes to, as the user record says when it is sent.

UserMailTexts

The keys and English defaults of the text user mail carries outside a component — the unsubscribe footer, the unsubscribe page and the invitation — and of the lines the page shares with the preferences view: always sent, and how often.

UserMessage

A message to write to chosen users, as handed to SendAsync(UserMessage, CancellationToken).

UserMessageAddressee

One user a selection reaches, as the list before sending shows them.

UserMessageAddresseePage

One page of the users a selection reaches, by name, with the counts PreviewAsync(UserMessageRecipients, string, CancellationToken) gives.

UserMessageCandidate

A user a message may be written to.

UserMessageChoices

What a message may be written to and in: the teams, the roles and access levels within them, the categories and the limits.

UserMessageFailure

Why the mail to one recipient of a message was given up.

UserMessageLimits

The limits a message is held to.

UserMessageLogEntry

A message as the log records it when it is sent.

UserMessageLogPage

One page of recorded messages.

UserMessageMember

One active membership a message may reach.

UserMessagePreview

How many people a selection reaches before it is sent, never who.

UserMessageRecipient

One recipient of a sent message and what became of the mail to them.

UserMessageRecipientPage

One page of a sent message's recipients.

UserMessageRecipients

Who a message goes to: a filter — the teams, and within them everyone, the roles or the access levels — and users added by key whatever the filter says, together and with duplicates removed.

UserMessageRolesAndLevels

The tenant roles and access levels members hold, which a message may be written to.

UserMessageTeam

A team a message may be written within.

UserMessageUserSearch

A search for users a message may be written to, as handed to SearchUsersAsync(UserMessageUserSearch, CancellationToken).

UserNameChangeResult

Result of SetUserNameAsync(string, string, bool, CancellationToken). The local write has always completed when this is returned — a failure there throws instead.

UserNoticeAudience

Who may receive a notice: the active members of the occurrence's team a rule admits, beside anyone the raiser names.

UserNoticeChoice

Whether one user receives one notice and how, and where that comes from.

UserNoticeComposed

What a composer decided to tell a user.

UserNoticeComposition

What a notice's composer is given when one user's mail of the notice is due.

UserNoticeCoverage

What the last mail of a notice to a user covered, and when each subject was last covered.

UserNoticeItem

One occurrence as it reaches one user.

UserNoticeOccurrence

Something that happened, handed to Tharga.Team.IUserNoticeRaiser so the users the notice concerns are told.

UserNoticeRecord

A raised occurrence as the outbox keeps it.

UserNoticeSetting

What a user or team set for one notice; a part left null follows the next default.

UserNoticeStreamClaim

A user's stream as it was when claimed.

UserNoticeTeamDefault

A team's default for one notice.

UserNoticeTexts

The keys and English defaults of the text notice mail carries around the notices themselves.

UserNoticeType

One kind of automatic notice in the host's catalogue: who may receive it, how it is delivered by default, which mail category it belongs to and how one occurrence reads.

UserNoticeWaiting

An occurrence waiting for a user's mail, and when it was raised.

UserProfileRefreshedEventArgs

A stored user's name and/or email, refreshed from a sign-in the host trusts.

UserServiceBase

UserServiceCompleteness

Finds persistence extension points a host has left un-overridden.

UserServiceGap

A persistence extension point on UserServiceBase whose default silently does nothing.

UserSignInIdentities

The directory's sign-in identities for one local user, as returned by GetSignInIdentitiesAsync(IEnumerable<string>, CancellationToken).

UserVerificationResult

Per-user item in a bulk verification stream (VerifyAllAsync(CancellationToken)).

CachedValue<T>

The result of a cache lookup: whether an entry existed, and its value.

SupportMailPosition

How far this deployment has read the support mailbox.

IApiKey

Represents an API key with associated metadata.

IApiKeyAdministrationService

Service for managing and validating API keys.

IApiKeyLifecycleHandler

Opt-in hook that receives an API key's private token at the moment it exists — on create and on recycle/regenerate — plus a tokenless signal on delete. Register one or more implementations with AddThargaApiKeyLifecycleHandler<T>(); they are invoked after the corresponding operation succeeds.

The token is handed only to in-process code the host explicitly registered. If the handler throws, the originating operation (create/recycle/delete) throws too — capture failures are not swallowed.

IApiKeyManagementService

User-facing management of a team's API keys. Every operation names the team it acts on as its first argument, and requires the Manage scope on that team — holding the scope for one team does not authorize acting on another.

IContactMessageService

Mail the product's staff write to contacts — people who are not users, listed by the host from its own records — and the log of every message sent; every member requires the system scope Send.

IIconProcessor

Optional pre-processing applied to icon bytes before they are stored — e.g. downscaling an oversized image so it fits the configured limits. The built-in store runs the registered processor before validating/persisting. Register an implementation (e.g. AddThargaImageProcessing from the Tharga.Team.Images package) to enable it; without one, icons are stored as-is.

IIconResolver

Resolves the image to display for a subject by running the registered IIconSources in order and returning the first non-null result. Returns null when no source supplies an image — the caller (e.g. an avatar component) then renders an initials/default fallback via IconInitials. Built-in; consumers customize resolution by registering sources, not by replacing the resolver.

IIconSettingsService

Reading and changing the site's icon settings. Requires a system users:manage grant.

IIconSettingsStore

Where the site's IconSettings are kept so they survive a restart. The built-in default (MongoIconSettingsStore in Tharga.Team.MongoDB) stores them in the database; a host can replace it to keep them somewhere else.

IIconSource

A source of icon images. This is the sourcing seam — where a displayed image comes from, separate from where bytes are stored (IIconStore). The platform runs the built-in StoredIconSource first (an explicitly-set icon wins), then the registered sources (via o.AddIconSource<T>()) in order, so a consuming system can supply icons for subjects that have no platform-stored icon — returning null to defer to the next source.

IIconStore

Pluggable storage for icon bytes. The built-in default (MongoIconStore in Tharga.Team.MongoDB) stores icons in the database; a consuming system can replace it via o.AddIconStore<T>() to store elsewhere (Azure Blob, S3, an existing DMS, …). This is the storage seam — where bytes live; where a displayed image is sourced from is the separate IIconSource seam.

IInboundMailContentStore

Keeps the raw content of received mail where the host wants it — blob storage, a file share — so nothing large reaches the toolkit's own store.

IPostmasterService

The postmaster: mail that reached the shared mailbox at an address no team owns.

IScopeRegistry

Registry of all known scopes. Used at runtime to resolve effective scopes for an access level.

ISupportAiConnectionService

What the support assistant answers a team with — the platform's model, the team's own provider, or nothing — chosen by the team.

ISupportAiConnectionStore

Keeps each team's AI connection. The persistence port behind ISupportAiConnectionService.

ISupportAssistantUsageService

Reads the support assistant's usage, for the staff who run the product or bill it.

ISupportAssistantUsageSink

Receives a SupportAssistantUsageRecord every time the support assistant is asked.

ISupportAssistantUsageStore

Keeps the support assistant's usage records, and totals them.

ISupportCaseNotifier

Tells the host when a support case changed, whichever side changed it.

ISupportCaseStore

The persistence port for support cases — what the domain needs from a store, in the domain's language.

ISupportChannel

Projects a support case onto an external system, and carries messages to it.

ISupportEventLedger

Remembers which inbound channel events have already been handled, so a redelivery is not applied twice.

ISupportMailPositionStore

Remembers how far the support mailbox has been read, so a restart does not re-read it from the start.

ISupportPresence

Whether anybody is on support right now.

ISupportResponder

Answers a support case on behalf of an assistant.

ISupportTypingNotifier

Tells the host when somebody is writing in a support case, so the other side can show that an answer is on its way.

ISystemApiKeyManagementService

User-facing management of system API keys — keys not bound to any team. All methods require the SystemManage scope and no team need be selected.

ISystemRoleRegistry

Maps app/global roles (e.g. "Developer", "Administrator") to system-level scopes, so privileged users gain those scopes as claims — the user-side counterpart to a system API key's explicit scope list.

ISystemScopeRegistry

Registry of system-level (global) scopes — the capabilities a system API key (or a privileged role) may hold. Separate from the team IScopeRegistry, which is access-level based and team-scoped.

ITeam

ITeamAccessRequestService

Requesting access to teams, and seeing requests across teams — the interface a component, controller or MCP provider should inject for them. Filtered rather than scope-gated.

ITeamCache

Where the toolkit keeps the three lookups its claims path performs on every authenticating request: the caller, their membership in the selected team, and that team's custom roles.

ITeamClaimsEnricher

Implement to inject custom claims (e.g. global roles) before team consent evaluation. Register via AddClaimsEnricher<T>() on ThargaBlazorOptions. Called once per request inside TeamServerClaimsTransformation, before member lookup and consent check.

ITeamDirectoryService

The caller's own teams and their own standing in them — the interface a component, controller or MCP provider should inject to list those teams, ask whether their membership in one is suspended, read their own access to it, or leave it. The listing is scope-filtered rather than scope-gated: each team is included only if the caller's membership in that team grants team:read. The rest is ungated, because it concerns only the caller's own membership.

ITeamEmailSender

Sends the invitation email. Implement it to use your own mail infrastructure (SendGrid, Azure, an existing pipeline) instead of the built-in SMTP sender.

ITeamInvitationService

Resolves an invite code to the invitation it names — the interface an invitation screen should inject.

ITeamLifecycleService

Team lifecycle operations that precede a team existing, and so cannot be authorized against one.

ITeamMailKeyStore

Keeps teams' mail keys. The persistence port behind ITeamMailboxService.

ITeamMailNotifier

Tells the host when mail arrived, was handled or was routed.

ITeamMailStore

Keeps received mail, for a team's mailbox and for the postmaster. The persistence port behind ITeamMailboxService and IPostmasterService.

ITeamMailboxService

A team's mailbox: its address, and the mail that arrived at it.

ITeamManagementService

The scope-checked entry point for team operations — the interface a component, controller or MCP provider should inject. Every member carries a [RequireScope] attribute enforced by ScopeProxy, so a caller lacking the scope is refused before the operation runs.

ITeamMember

ITeamMemberRemovalParticipant

A store holding data that belongs to a member of a team, to be cleaned up when they stop being one.

ITeamOversightService

Every team, regardless of membership — the interface a component, controller or MCP provider should inject for cross-team discovery. Requires the Read system scope.

ITeamPurgeParticipant

A store holding data for a team, which must be destroyed when that team is purged.

ITeamScopeVisibilityProvider

Decides whether a given scope should be offered for a given team. Consulted by the scope pickers (team members' scope overrides, team API keys, custom roles) before listing scopes, and by the access page (ScopeView) before listing its rows, letting a consumer hide the scopes of a feature that is switched off for that team. The scope equivalent of ITenantRoleVisibilityProvider.

ITeam<TMember>

ITenantRoleRegistry

Registry of tenant role definitions. Used at runtime to resolve scopes for assigned roles.

ITenantRoleService

Team-aware view over tenant roles: composes the global code-registered roles (ITenantRoleRegistry) with a team's runtime-defined custom roles, and resolves the effective scopes for a member of a specific team. This is the resolution path that lets a member assigned a custom role receive that role's scopes — the team-blind ITenantRoleRegistry only knows code roles.

ITenantRoleVisibilityProvider

Decides whether a given tenant role should be offered in the role editor for a given team. Consulted by the team role editor before building its per-team role list, letting a consumer hide feature-gated roles from teams where the feature is disabled.

ITextResolver

Resolves a user-facing string outside a component, such as in a mail or a server-rendered page, by its key with its English default.

IUser

IUserCacheInvalidator

Implemented by a user store that caches resolved users, so something outside it can drop a stale entry. UserServiceBase implements it; a store written from scratch need not.

IUserDirectoryService

Pluggable connection to an external user directory (e.g. Microsoft Entra ID). Optional — registered via AddUserDirectoryService<T>() on the platform options; when not registered, directory features (verify, directory-only listing, directory delete) are unavailable and their UI is hidden.

IUserIdentityDirectory

Reads the sign-in identities a directory holds for a user, so a host can link a directory user to an identity in another system. Unchecked, like IUserDirectoryService: call it from server-side code that has already authorized the caller.

IUserMailHistoryService

The mail sent to one user — messages, notices, mail queued on its own and invitations — read by that user or by staff holding Manage.

IUserMailPreferenceService

Which categories of mail a user receives, read and changed by that user or by staff holding Manage.

IUserManagementService

User administration operations: directory verification and user deletion. Authorization is enforced in the service layer by an authorization decorator; the [RequireScope] attributes here document the scope each operation requires. All operations require the Manage system scope. Directory-backed operations require a registered IUserDirectoryService.

IUserMessageService

Messages the product's staff write to chosen users of its teams, and the log of every message sent; every member requires the system scope Send.

IUserNoticePreferenceService

Which automatic notices a user receives and how, read and changed by that user or by staff holding Manage.

IUserNoticeTeamService

A team's defaults for automatic notices, used for its members who have not chosen; every member requires the team scope Manage.

IUserService

The user store. Authorization is enforced in the service layer by AuthorizationUserServiceDecorator: resolving the current user and the invitation-accept name seeding are self-service; setting a display name is allowed on the caller's own record (otherwise users:manage); the [RequireScope]-annotated members document the scope they require.

AccessLevel

ApiKeyLifecycleReason

Why an IApiKeyLifecycleHandler is being invoked.

ApiKeyOwnership

Which kinds of API key people can create: shared keys, personal keys, or both. Set per key kind with TeamKeys and SystemKeys.

AuditMode

Whether a call through an enforcement proxy is recorded in the audit log, declared on the method rather than configured centrally.

ContactAddresseeStatus

Whether a listed address will be mailed.

ContactMailSuppressionSource

How an address came to be opted out of contact mail.

ContactRecipientStatus

Where the mail to one address of a message to contacts stands.

DirectoryUserStatus

Outcome of verifying a local user against the external directory (VerifyUserAsync(IUser, CancellationToken)).

IconKind

What an icon belongs to. Lets a single IIconStore / IIconSource serve both teams and users.

InboundMailFilter

Which of a team's mail to list.

InvitationStatus

Whether an invitation is still acceptable.

MailKeyRole

Whether a team's mail key is the one in use or the one being phased out.

MailPolicyEffect

What an environment's outbound mail policy does with a mail to one address.

MailRouteReason

Why a received mail went where it did.

MembershipState

PostmasterMailState

Which of the postmaster's mail to list.

PrivateKeyOwnerRemovedAction

What to do with a member's private API keys in a team when they stop being a member of it.

PrivateKeyScope

Controls which owner-scoped ("private") API keys a listing includes, on top of the normal team-wide keys. The actual entitlement is always intersected with the caller's identity, so these values can never reveal a key the caller isn't allowed to see.

SupportAiConnectionKind

What the support assistant answers a team with.

SupportAnswerRating

How the person the assistant answered found an answer.

SupportAssistance

Whether the person raising a case wants an assistant to answer it.

SupportAssistantReadiness

Whether an assistant can answer for a team, and if not, why.

SupportAssistantState

Whether an assistant is answering a case, and whether it has handed over.

SupportCaseChange

What happened to a support case.