Skip to main content
Version: Current

Verified Production-Style Role Matrix

Use this page when you need the RBAC flow that is closest to a real authenticated multi-tenant host.

What this path proves​

  • JWT authentication is enforced through PrimusSaaS.Identity.Validator.
  • Tenant selection is checked against the caller's memberships before RBAC runs.
  • The same five-role RBAC matrix still holds under an authenticated pipeline.
  • Tenant-scoped RBAC admin APIs support create, update, assign, revoke, delete, and audit flows.
  • The sample uses current workspace packages through an isolated local package cache.

Current validation evidence​

  • dotnet test sdk/dotnet/tests/PrimusSaaS.Rbac.Tests/PrimusSaaS.Rbac.Tests.csproj --framework net9.0 --filter FullyQualifiedName~ProductionStyleRbac /p:CollectCoverage=false --nologo Current run: 63/63 passed.
  • Focused admin lifecycle coverage is implemented in ProductionStyleRbacAdminApiTests.cs.
  • examples/RbacProductionStyleValidation/verify-live.sh The verifier defines 72 live HTTP cases across the role matrix, tenant checks, and admin lifecycle.
  • CI workflow: rbac-production-style-validation.yml

Validation host​

The reference host is examples/RbacProductionStyleValidation.

It validates:

  • local JWT token issuance through /dev/token
  • membership-validated X-Tenant-Id selection
  • tenant-scoped role and assignment management
  • audit reads with before and after mutation state

Admin endpoints exercised by the verification flow:

  • GET /api/rbac/permissions
  • GET /api/rbac/roles
  • GET /api/rbac/roles/{roleId}
  • POST /api/rbac/roles
  • PUT /api/rbac/roles/{roleId}
  • DELETE /api/rbac/roles/{roleId}
  • GET /api/rbac/assignments
  • GET /api/rbac/principals/{principalId}/assignments
  • POST /api/rbac/assignments
  • DELETE /api/rbac/assignments/{assignmentId}
  • POST /api/rbac/access/evaluate
  • GET /api/rbac/audit

Run the verified flow locally​

bash examples/RbacProductionStyleValidation/run-development.sh

This flow restores into an isolated local package cache so the host consumes packages built from the current workspace instead of a stale global NuGet cache.

Run the full verifier​

bash examples/RbacProductionStyleValidation/verify-all.sh

That command runs:

  • the focused authenticated RBAC slices
  • the live HTTP verifier

Use this path instead of the blind role matrix when​

  • you need authenticated requests, not debug headers
  • you need membership-validated tenant selection
  • you need evidence for the admin API lifecycle