DKNet.EfCore.DataAuthorization 12.0.0

DKNet.EfCore.DataAuthorization

Row-level, ownership-based data authorization for EF Core: an automatic global query filter plus a SaveChanges hook, so multi-tenant or per-user data isolation is enforced by the persistence layer instead of by convention in every query.

Install

dotnet add package DKNet.EfCore.DataAuthorization

Features

• IOwnedBy — marker interface entities implement to opt into ownership-based filtering and stamping.
• Automatic global query filter — every IOwnedBy entity is scoped to IDataOwnerDbContext.AccessibleKeys automatically; deny-by-default when empty, with an explicit IsUnrestrictedAccess escape hatch for admin/system contexts. Not bypassable via specification IsIgnoreQueryFilters.
• Automatic ownership stamping — a SaveChanges hook stamps the current owner key onto newly added IOwnedBy entities (and CreatedBy/CreatedOn when the entity is also audited), and reverts any attempt to silently reassign an existing row's owner to a key the caller can't access.
• Composes with signed-in-user auditing — when an ICurrentUserProvider from DKNet.EfCore.AuditLogs supplies a non-empty user for the save, this package stamps OwnedBy only and the audit identity comes from that provider. Whenever it does not — no such provider registered, or one that returned null/empty — the ownership key keeps filling CreatedBy/UpdatedBy exactly as before, so existing applications need no code change.
• One DI call to wire it up — AddDataOwnerProvider<TDbContext, TProvider>() registers the query filter, the hook, and your IDataOwnerProvider implementation together. TDbContext must implement IDataOwnerDbContext; the requirement is compile-enforced by the method's generic constraint.

Quick start

public class Invoice : IOwnedBy
{
    public string OwnedBy { get; private set; } = string.Empty;
}

public class AppDbContext(DbContextOptions<AppDbContext> options) : DbContext(options), IDataOwnerDbContext
{
    public IEnumerable<string> AccessibleKeys { get; init; } = [];
}

public sealed class TenantOwnerProvider(ICurrentTenant currentTenant) : IDataOwnerProvider
{
    public string? GetOwnershipKey() => currentTenant.TenantId;
}

services
    .AddDataOwnerProvider<AppDbContext, TenantOwnerProvider>()
    .AddDbContextWithHook<AppDbContext>(options =>
        options.UseSqlServer(connectionString)
               .UseAutoConfigModel<AppDbContext>()); // required for the global query filter to apply

AddDataOwnerProvider<TDbContext, TProvider>() is declared where TDbContext : DbContext, IDataOwnerDbContext, so a DbContext without the interface does not compile — and a context that reaches the query filter without it throws InvalidOperationException at model-build time rather than quietly applying no ownership filter.

Customisation reference

There is no options class and nothing bound from appsettings.json — the whole surface is the three interfaces you implement plus one DI call.

The hook stamps OwnedBy (and CreatedBy/CreatedOn on audited entities) only when they are still blank, keeps an explicit SetUpdatedBy from being overwritten, and reverts an OwnedBy change that targets a key outside GetAccessibleKeys().

User identity vs. ownership

Ownership and "who did this" are separate keys, and only ownership belongs here. To stamp CreatedBy/UpdatedBy with the signed-in user rather than the tenant key, register an ICurrentUserProvider via AddCurrentUserProvider<TDbContext, TProvider>() from DKNet.EfCore.AuditLogs; that package documents the provider contract and the identifier to return. Both providers are independent and optional — adding one changes neither the global query filter nor the ownership-reassignment guard described above.

Full documentation, configuration options, and gotchas: DKNet.EfCore.DataAuthorization docs