rework policies to use permissions over roles

2026-04-22 19:34:55 -05:00
parent 1a0bf385b6
commit 152db3d99f
6 changed files with 27 additions and 12 deletions
--- a/api/Program.cs
+++ b/api/Program.cs
@@ -49,11 +49,9 @@ builder.Services.AddAuthentication(options => {
 builder.Services.AddAuthorization(options => {

    options.AddPolicy("SensitiveDataRead", policy =>
-        policy.RequireRole("admin", "superuser"));
+        policy.RequireClaim("permission", Permission.SensitiveData_Read));
    options.AddPolicy("SensitiveDataModify", policy =>
-        policy.RequireRole("superuser"));
-    
-    // TODO: policies are read at runtime. define policy names in a central place and distribute the symbol
+        policy.RequireClaim("permission", Permission.SensitiveData_Modify));

 });