Class AuthorizedPrincipal
- Namespace
- MailFathom.Application.Access
- Assembly
- MailFathom.Application.dll
Whoever a unit of work is running for, and what they were granted.
public sealed class AuthorizedPrincipal- Inheritance
-
AuthorizedPrincipal
- Inherited Members
Remarks
This is the whole of what the application layer learns about the outside of a request. It carries the identity the work was admitted under and the permissions that identity holds, and nothing else: no credential, no claim an authorization server issued, no scheme, no transport. Which credential admitted a caller is a question the transport answered and no use case has any business re-deciding, which is why nothing here can be asked it.
It is an ordinary class rather than a record, because two principals are never compared. A record's generated equality would compare Permissions by reference and report two identical grants as different, which is worse than having no equality at all.
The three factories below are the only way to obtain one, so a principal always states which kind it is and a kind added later cannot arrive with an unset identity. Process is a single instance because there is one process and it holds no per-work state.
Fields
- ProcessIdentityName
The name the process's own identity is reported under, which is MailFathom itself rather than anything an operator configured.
Properties
- Identity
Gets the identity the work was admitted under.
- Kind
Gets which of the three things this principal is.
- Permissions
Gets the permissions this principal holds, which is empty for every kind but a caller.
- Process
Gets the principal work no caller requested runs under.
Methods
- Caller(string, IEnumerable<MailFathomPermission>)
Describes a caller the transport admitted.
- Holds(MailFathomPermission)
Reports whether this principal was granted one named capability.
- SignedCapability(string)
Describes the principal a verified signature produced.