Authorization

public async Task<AuthorizationPolicy?> GetPolicyAsync(string policyName)
{
    if (policyName.StartsWith(RequirePermissionAttribute.PolicyPrefix, ...)) // "Permission:"
    {
        var permission = policyName[RequirePermissionAttribute.PolicyPrefix.Length..];
        return new AuthorizationPolicyBuilder()
            .RequireAuthenticatedUser()
            .AddRequirements(new PermissionAuthorizationRequirement(permission))
            .AddRequirements(new ActiveAccountRequirement())
            .Build();
    }
    // "Scope:" → ScopeAuthorizationRequirement
    // bilinmeyen policy → default provider'a düşer (ama ActiveAccountRequirement eklenir)
}

[RequirePermission("users:read")]   // → Policy = "Permission:users:read"
public async Task<IActionResult> List(...) => ...;

builder.Services.AddSingleton<IAuthorizationPolicyProvider, DynamicPermissionPolicyProvider>();
builder.Services.AddScoped<IAuthorizationHandler, PermissionAuthorizationHandler>();
builder.Services.AddScoped<IAuthorizationHandler, ScopeAuthorizationHandler>();
builder.Services.AddScoped<IAuthorizationHandler, ActiveAccountAuthorizationHandler>();

var permissions = context.User.Claims
    .Where(c => c.Type == DiyanetCleanArchitectureClaimTypes.Permissions)
    .Select(c => c.Value).ToHashSet();

bool granted = permissions.Contains("*:*") ||
               permissions.Contains(requirement.Permission);
if (granted) context.Succeed(requirement);

bool granted = scope == requirement.Scope ||
               scope == "shared" ||
               context.User.Claims.Any(c => c.Type == Permissions && c.Value == "*:*");

var endpoint = httpContext.GetEndpoint();
if (endpoint?.Metadata.GetMetadata<AllowPendingAccountAttribute>() is not null)
{
    context.Succeed(requirement);   // Pending/Banned/Suspended bypass
    return Task.CompletedTask;
}
var status = context.User.FindFirstValue(DiyanetCleanArchitectureClaimTypes.AccountStatus);
if (string.Equals(status, "Active", StringComparison.OrdinalIgnoreCase))
    context.Succeed(requirement);

options.AddPolicy(AuthPolicies.PersonelAuthenticated, p => p
    .AddAuthenticationSchemes(KeycloakSchemeNames.Personel).RequireAuthenticatedUser());
options.AddPolicy(AuthPolicies.VatandasAuthenticated, p => p
    .AddAuthenticationSchemes(KeycloakSchemeNames.Vatandas).RequireAuthenticatedUser());
options.AddPolicy(AuthPolicies.AnyKeycloakAuthenticated, p => p
    .AddAuthenticationSchemes(KeycloakSchemeNames.Vatandas, KeycloakSchemeNames.Personel)
    .RequireAuthenticatedUser());

[Authorize(Policy = AuthPolicies.PersonelAuthenticated)]
public async Task<IActionResult> Me(...) => ...;

public class UpdateStaffCommand : IRequest<Result>, IRequirePermissions
{
    public string[] RequiredPermissions => [ "users:write" ];
}