authorization-policy-generator

Authorization Policy Generator

Design ASP.NET Core authorization the right way: named policies over scattered role strings, custom requirements/handlers for real rules, and resource-based checks for "can this user act on this object".

Input — point it at your project

Works on a target: a project or GitHub URL. Inspect current setup: grep -rn "AddAuthorization\|RequireRole\|RequireClaim\|\[Authorize\|RequireAuthorization\|IAuthorizationHandler" --include=*.cs <target>.

Named policies (not role strings everywhere)

builder.Services.AddAuthorizationBuilder()
    .AddPolicy("CanManageOrders", p => p.RequireClaim("permission", "orders:manage"))
    .AddPolicy("AdminOnly", p => p.RequireRole("Admin"))
    .AddPolicy("Over18", p => p.AddRequirements(new MinimumAgeRequirement(18)));

Custom requirement + handler (real business rules)

public record MinimumAgeRequirement(int Age) : IAuthorizationRequirement;

public class MinimumAgeHandler : AuthorizationHandler<MinimumAgeRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext ctx, MinimumAgeRequirement req)
    {
        var dob = ctx.User.FindFirst("dob")?.Value;
        if (DateTime.TryParse(dob, out var d) && d.AddYears(req.Age) <= DateTime.Today)
            ctx.Succeed(req);
        return Task.CompletedTask;
    }
}
builder.Services.AddSingleton<IAuthorizationHandler, MinimumAgeHandler>();

Resource-based (can THIS user act on THIS object)

var auth = await _authService.AuthorizeAsync(User, order, "OrderOwnerPolicy");
if (!auth.Succeeded) return Results.Forbid();

This is how you stop IDOR — ownership checked against the actual resource, not just a role.

Wiring endpoints

app.MapPost("/orders", ...).RequireAuthorization("CanManageOrders");
group.RequireAuthorization("AdminOnly");
// Consider a FallbackPolicy so endpoints are authenticated by default.

Principles

• Policies over inline role strings — one named policy, reused, easy to change.
• Requirements/handlers for business rules, not giant if (User.IsInRole(...)) blocks.
• Resource-based authorization prevents IDOR — check ownership, not just role.
• Consider a fallback policy so new endpoints aren't accidentally anonymous.