stabilizaiton work - projects rework for maintenanceability and ui livening

src/__Libraries/StellaOps.Configuration/AuthorityTenantRoleOptions.Validation.cs

@@ -0,0 +1,42 @@
+using StellaOps.Auth.Abstractions;
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Configuration;
+
+public sealed partial class AuthorityTenantRoleOptions
+{
+    private static readonly HashSet<string> _allowedAttributeKeys = new(new[]
+    {
+        "env",
+        "owner",
+        "business_tier"
+    }, StringComparer.OrdinalIgnoreCase);
+
+    internal void Validate(string tenantId, string roleName)
+    {
+        if (Scopes.Count == 0)
+        {
+            throw new InvalidOperationException($"Tenant '{tenantId}' role '{roleName}' must specify at least one scope.");
+        }
+
+        foreach (var scope in Scopes)
+        {
+            if (!StellaOpsScopes.IsKnown(scope))
+            {
+                throw new InvalidOperationException($"Tenant '{tenantId}' role '{roleName}' references unknown scope '{scope}'.");
+            }
+        }
+
+        if (Attributes.Count > 0)
+        {
+            foreach (var attributeName in Attributes.Keys)
+            {
+                if (!_allowedAttributeKeys.Contains(attributeName))
+                {
+                    throw new InvalidOperationException($"Tenant '{tenantId}' role '{roleName}' defines unsupported attribute '{attributeName}'. Allowed attributes: env, owner, business_tier.");
+                }
+            }
+        }
+    }
+}