Policy-Based Authorization

using Microsoft.AspNetCore.Authorization;

// ━━ Custom requirement ━━
// 'User must have verified their phone number'
public class PhoneVerifiedRequirement : IAuthorizationRequirement { }

// ━━ Handler evaluates the requirement ━━
public class PhoneVerifiedHandler : AuthorizationHandler<PhoneVerifiedRequirement>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        PhoneVerifiedRequirement requirement)
    {
        if (context.User.HasClaim("phone_verified", "true"))
            context.Succeed(requirement);
        else
            context.Fail(new AuthorizationFailureReason(this, "Phone number not verified"));

        return Task.CompletedTask;
    }
}

// ━━ Combined requirement — subscription tier ━━
public class MinimumSubscriptionRequirement(string minimumTier) : IAuthorizationRequirement
{
    public string MinimumTier { get; } = minimumTier;
}

public class SubscriptionTierHandler : AuthorizationHandler<MinimumSubscriptionRequirement>
{
    private static readonly Dictionary<string, int> TierRank = new()
        { ["free"] = 0, ["starter"] = 1, ["pro"] = 2, ["enterprise"] = 3 };

    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        MinimumSubscriptionRequirement requirement)
    {
        var userTier = context.User.FindFirstValue("subscription_tier") ?? "free";
        var required = requirement.MinimumTier;

        if (TierRank.TryGetValue(userTier, out var userRank) &&
            TierRank.TryGetValue(required, out var reqRank) &&
            userRank >= reqRank)
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }
}

// ━━ Register policies ━━
builder.Services.AddAuthorizationBuilder()
    .AddPolicy("RequireAdmin", policy => policy.RequireRole("Admin"))
    .AddPolicy("RequireManager", policy => policy.RequireRole("Admin", "Manager"))
    .AddPolicy("RequireVerifiedPhone", policy =>
        policy.RequireAuthenticatedUser()
              .AddRequirements(new PhoneVerifiedRequirement()))
    .AddPolicy("RequireProPlan", policy =>
        policy.RequireAuthenticatedUser()
              .AddRequirements(new MinimumSubscriptionRequirement("pro")))
    .AddPolicy("CanManageProducts", policy =>
        policy.RequireAuthenticatedUser()
              .RequireRole("Admin", "Manager")
              .RequireClaim("department", "catalog"))
    .AddPolicy("SameCountryOnly", policy =>
        policy.RequireClaim("country", "US", "CA", "GB")); // enumerable overload

builder.Services.AddSingleton<IAuthorizationHandler, PhoneVerifiedHandler>();
builder.Services.AddSingleton<IAuthorizationHandler, SubscriptionTierHandler>();

// ━━ Usage ━━
[Authorize(Policy = "RequireProPlan")]
[HttpGet("analytics")]
public IActionResult GetAnalytics() => Ok("Pro analytics data");