| | | 1 | | using System.Text.Json.Serialization; |
| | | 2 | | using ArturRios.Heimdall.Shared.Security; |
| | | 3 | | using ArturRios.Mediator.Query; |
| | | 4 | | |
| | | 5 | | namespace ArturRios.Heimdall.Query.Input; |
| | | 6 | | |
| | | 7 | | /// <summary> |
| | | 8 | | /// Request to list the permissions of a scope, with pagination and optional filtering (UC-32, |
| | | 9 | | /// FR-SP-05). <see cref="ScopeId" /> comes from the route; |
| | | 10 | | /// <see cref="ActingPersonId" />/<see cref="ActingRole" /> are set by the controller from the |
| | | 11 | | /// authenticated caller and are never taken from the request — a Scope Admin sees only the |
| | | 12 | | /// permissions of a scope they own, so a forged acting id would be a forged answer. A scope |
| | | 13 | | /// permission has no owner of its own, so there is no owner filter. All three are |
| | | 14 | | /// <c>[JsonIgnore]</c>, which <c>ServerPopulatedBindingMetadataProvider</c> turns into |
| | | 15 | | /// "not bindable", so they never reach the public contract. |
| | | 16 | | /// </summary> |
| | | 17 | | public class ListScopePermissionsQuery : BaseQuery, IActorScoped |
| | | 18 | | { |
| | | 19 | | /// <summary>Public identifier of the scope whose permissions are listed (assigned from the route).</summary> |
| | | 20 | | [JsonIgnore] |
| | 41 | 21 | | public Guid ScopeId { get; set; } |
| | | 22 | | |
| | | 23 | | /// <summary>Optional case-insensitive substring filter on the permission's name.</summary> |
| | 39 | 24 | | public string? Name { get; set; } |
| | | 25 | | |
| | | 26 | | /// <summary>When <c>true</c>, logically deleted permissions are included (FR-SP-09).</summary> |
| | 16 | 27 | | public bool IncludeDeleted { get; set; } |
| | | 28 | | |
| | | 29 | | [JsonIgnore] |
| | 38 | 30 | | public Guid ActingPersonId { get; set; } |
| | | 31 | | |
| | | 32 | | [JsonIgnore] |
| | 38 | 33 | | public int ActingRole { get; set; } |
| | | 34 | | } |