Rafał Tyński
482a4b41f0
Add signup/signin with backend-issued JWT (Argon2 passwords in SurrealDB), role-based authorization policies, per-user data access levels, consent register and read audit log. Protect user endpoints and record sensitive reads.
48 lines
1.5 KiB
C#
48 lines
1.5 KiB
C#
namespace TarninaHub.Application.Security;
|
|
|
|
public static class RoleNames
|
|
{
|
|
public const string User = "user";
|
|
public const string Jst = "jst";
|
|
public const string Operator = "operator";
|
|
public const string Manager = "manager";
|
|
public const string Admin = "admin";
|
|
|
|
public static readonly IReadOnlyList<string> All =
|
|
[User, Jst, Operator, Manager, Admin];
|
|
|
|
public static bool IsValid(string role) => All.Contains(role);
|
|
}
|
|
|
|
public static class Policies
|
|
{
|
|
/// <summary>operator, manager, admin — ROPS/expert staff.</summary>
|
|
public const string Staff = "Staff";
|
|
|
|
/// <summary>operator, admin.</summary>
|
|
public const string OperatorOrAdmin = "OperatorOrAdmin";
|
|
|
|
/// <summary>manager, operator, admin.</summary>
|
|
public const string ManagerOrAbove = "ManagerOrAbove";
|
|
|
|
/// <summary>admin only.</summary>
|
|
public const string AdminOnly = "AdminOnly";
|
|
|
|
/// <summary>jst and above (jst, operator, manager, admin).</summary>
|
|
public const string JstOrAbove = "JstOrAbove";
|
|
}
|
|
|
|
public static class ConsentScopes
|
|
{
|
|
/// <summary>Access granted by the data subject's consent.</summary>
|
|
public const string ByConsent = "by-consent";
|
|
|
|
/// <summary>Time-limited access (uses consent.expires_at).</summary>
|
|
public const string Temporary = "temporary";
|
|
|
|
/// <summary>Fully anonymized data (no personal identifiers).</summary>
|
|
public const string Anonymized = "anonymized";
|
|
|
|
public static readonly IReadOnlyList<string> All = [ByConsent, Temporary, Anonymized];
|
|
}
|