up

src/AirGap/StellaOps.AirGap.Controller/Auth/HeaderScopeAuthenticationHandler.cs

@@ -0,0 +1,37 @@
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.Extensions.Options;
+
+namespace StellaOps.AirGap.Controller.Auth;
+
+public sealed class HeaderScopeAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public const string SchemeName = "HeaderScope";
+
+    #pragma warning disable CS0618 // ISystemClock obsolete; base ctor signature still requires it on this TF.
+    public HeaderScopeAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder,
+        ISystemClock clock) : base(options, logger, encoder, clock)
+    {
+    }
+    #pragma warning restore CS0618
+
+    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        // Accept any request; scopes are read from `scope` header (space-separated)
+        var claims = new List<Claim> { new(ClaimTypes.NameIdentifier, "anonymous") };
+
+        if (Request.Headers.TryGetValue("scope", out var scopeHeader))
+        {
+            claims.Add(new("scope", scopeHeader.ToString()));
+        }
+
+        var identity = new ClaimsIdentity(claims, SchemeName);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, SchemeName);
+        return Task.FromResult(AuthenticateResult.Success(ticket));
+    }
+}