Hellmade.HubAuth.AspNetCore

ASP.NET Core integration helpers for services authenticating with a standard OIDC provider such as Zitadel while using Hub for coarse access checks and profile data.

Includes

• AddHubOidcAuthentication(...) -- configures Cookie + OpenID Connect authentication
• HubOidcAuthenticationOptions -- OIDC issuer, client ID, callback paths, optional client secret, and scopes
• HubPermissionGateMiddleware -- gates authenticated requests through Hub's permission check
• HubPermissionGateOptions -- service key, excluded paths, skipped auth schemes
• HubUserProjectionClaimsTransformationBase -- abstract base for projecting Hub users into local stores
• HubUserProjectionContext -- context record passed to the upsert method

Scope

• Service authentication and permission gating wiring.
• Keep service-local authorization rules and entity-specific upsert logic in each consuming service.

Permission gate quick start

services.AddHubAuthServiceClients(options =>
{
    options.HubApiBaseUrl = configuration["AUTH:Hub:ApiBaseUrl"] ?? string.Empty;
});

services.AddHubOidcAuthentication(options =>
{
    options.OidcIssuer = configuration["AUTH:OIDC:ISSUER"] ?? string.Empty;
    options.ClientId = configuration["AUTH:CLIENT_ID"] ?? string.Empty;
    options.ClientSecret = configuration["AUTH:CLIENT_SECRET"];
    options.IncludeServiceScope = false;
});

app.UseAuthentication();
app.UseMiddleware<HubPermissionGateMiddleware>(new HubPermissionGateOptions
{
    ServiceKey = configuration["SERVICE:KEY"] ?? string.Empty,
    SkipForAuthenticationSchemes = new[] { "PersonalAccessToken" }
});
app.UseAuthorization();