Skip to main content

ConsentConstraintEnforcer Class

Abblix.Oidc.Server​

Abblix.Oidc.Server.Endpoints.Authorization​

ConsentConstraintEnforcer Class​

Default IConsentConstraintEnforcer. Asserts granted ⊆ requested for scopes, resources (including their nested scopes) and RFC 9396 authorization_details, throwing when the consent provider returned anything outside the request.

public class ConsentConstraintEnforcer : Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer

Inheritance System.Object → ConsentConstraintEnforcer

Implements IConsentConstraintEnforcer

Constructors​

ConsentConstraintEnforcer(IAuthorizationDetailsPolicy) Constructor​

Default IConsentConstraintEnforcer. Asserts granted ⊆ requested for scopes, resources (including their nested scopes) and RFC 9396 authorization_details, throwing when the consent provider returned anything outside the request.

public ConsentConstraintEnforcer(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy authorizationDetailsPolicy);

Parameters​

authorizationDetailsPolicy IAuthorizationDetailsPolicy​

Re-runs granted authorization_details through the per-type validators and per-client allowlist; the per-type validator owns the "is B a narrowing of A" decision for intra-entry content (RFC 9396 has no universal comparator).

Methods​

ConsentConstraintEnforcer.EnforceAsync(ValidAuthorizationRequest, ConsentDefinition, CancellationToken) Method​

Asserts that the granted consent does not exceed the request. The granted set is left unchanged on success.

public System.Threading.Tasks.Task EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Features.Consents.ConsentDefinition granted, System.Threading.CancellationToken cancellationToken);

Parameters​

request ValidAuthorizationRequest​

The validated authorization request carrying the requested scopes, resources and authorization_details.

granted ConsentDefinition​

The consent decision produced by IUserConsentsProvider.

cancellationToken System.Threading.CancellationToken​

Cancellation token.

Implements EnforceAsync(ValidAuthorizationRequest, ConsentDefinition, CancellationToken)

Returns​

System.Threading.Tasks.Task

Exceptions​

System.InvalidOperationException
Thrown when the granted set contains a scope, resource, resource scope or authorization_details entry absent from — or broader than — the request.