Hellmade.ServiceAccess.Client

Client package for checking user access to a service via Hub.

Purpose

• centralize Hub permissions/check API calls
• provide short-lived caching for resilience
• keep per-service integration minimal and consistent

Interface

• IServiceAccessAuthorizer
  • HasAccessAsync(externalUserId, serviceKey, bearerToken, cancellationToken)

DI wiring

services.AddHubServiceAccessAuthorizer(options =>
{
    options.HubApiBaseUrl = "https://hub-api.internal";
    options.CacheSeconds = 120;
    options.FailOpenWithCachedValue = true;
});

Middleware usage example

var externalUserId = context.User.FindFirstValue("sub");
var bearerToken = context.Request.Headers.Authorization.ToString().Replace("Bearer ", "");

var hasAccess = await authorizer.HasAccessAsync(
    externalUserId!,
    "my-service-key",
    bearerToken,
    context.RequestAborted);

if (!hasAccess)
{
    context.Response.StatusCode = StatusCodes.Status403Forbidden;
    return;
}

Onboarding checklist for another service

1. Validate Clerk JWT locally.
2. Resolve user sub claim.
3. Call IServiceAccessAuthorizer with your serviceKey.
4. Deny request when HasAccessAsync is false.
5. Keep service-local roles/permissions separate from Hub access check.