Class PlatformAdminAwarePermissionService

Namespace

KadicAuth.Infrastructure.Services

Assembly

KadicAuth.Infrastructure.dll

Decorator over the base KadicErp.Core.Abstractions.Authorization.IPermissionService implementation (KadicErp.Core.Authentication.Services.PermissionService) that short circuits for active platform admins and tenant super admins.

Why a decorator instead of modifying the base class: KadicErp.Core.Authentication would have to reference KadicAuth.Application to see IPlatformAdminService, which creates a dependency cycle (KadicAuth.Application → KadicErp.Core.Authentication → KadicAuth.Application). This lives in KadicAuth.Infrastructure which already references both projects, so we get the behavior we need without touching the core auth services layer.

Wire-up: register this as the KadicErp.Core.Abstractions.Authorization.IPermissionService implementation in every API host (KadicAuth.Api, KadicErp.WebApi, KadicErp.Notifications.Api), AND also register the base KadicErp.Core.Authentication.Services.PermissionService (or RedisPermissionService when Redis is enabled) as a concrete type so the decorator has something to delegate to. There is no shared DI helper method for this — each host wires it up inline via builder.Services.AddScoped<IPermissionService>(sp => new PlatformAdminAwarePermissionService(...)) in its own Program.cs.

public sealed class PlatformAdminAwarePermissionService : IPermissionService

Inheritance

object

PlatformAdminAwarePermissionService

Implements

IPermissionService

Constructors

PlatformAdminAwarePermissionService(IPermissionService, ICurrentUser, IPlatformAdminService, ITenantSuperAdminService, IPermissionRepository)

public PlatformAdminAwarePermissionService(IPermissionService inner, ICurrentUser currentUser, IPlatformAdminService platformAdminService, ITenantSuperAdminService tenantSuperAdminService, IPermissionRepository permissionRepository)

Parameters

inner IPermissionService

currentUser ICurrentUser

platformAdminService IPlatformAdminService

tenantSuperAdminService ITenantSuperAdminService

permissionRepository IPermissionRepository

Methods

GetUserPermissionsAsync(CancellationToken)

Gets all permission codes for the current user based on their roles

public Task<IReadOnlyCollection<string>> GetUserPermissionsAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task<IReadOnlyCollection<string>>

HasPermissionAsync(string, CancellationToken)

Checks if the current user has a specific permission

public Task<bool> HasPermissionAsync(string permissionCode, CancellationToken cancellationToken = default)

Parameters

permissionCode string

cancellationToken CancellationToken

Returns

Task<bool>

InvalidateCacheAsync(Guid, Guid, Guid, CancellationToken)

Delegates cache invalidation to the inner service. The elevated all-permissions cache is scope-local (per-request), so there is nothing extra to clear here.

public Task InvalidateCacheAsync(Guid userId, Guid tenantId, Guid branchId, CancellationToken cancellationToken = default)

Parameters

userId Guid

tenantId Guid

branchId Guid

cancellationToken CancellationToken

Returns

Task

InvalidateTenantCacheAsync(Guid, CancellationToken)

Delegates tenant-wide cache invalidation to the inner service. The elevated all-permissions cache is scope-local (per-request), so there is nothing extra to clear here either.

public Task InvalidateTenantCacheAsync(Guid tenantId, CancellationToken cancellationToken = default)

Parameters

tenantId Guid

cancellationToken CancellationToken

Returns

Task