Что такое ClaimsPrincipal, Identity, Roles vs Policy-based auth?

ClaimsPrincipal user = HttpContext.User;

bool isAuthenticated = user.Identity?.IsAuthenticated == true;
string? userId = user.FindFirstValue(ClaimTypes.NameIdentifier);   // или "sub" — зависит от маппинга
string? email = user.FindFirstValue(ClaimTypes.Email);
bool isManager = user.IsInRole("Manager");
IEnumerable<string> permissions = user.FindAll("permission").Select(c => c.Value);

public interface ICurrentUser { Guid Id { get; } bool HasPermission(string p); }

public sealed class HttpCurrentUser(IHttpContextAccessor accessor) : ICurrentUser
{
    private ClaimsPrincipal User => accessor.HttpContext?.User ?? new ClaimsPrincipal();
    public Guid Id => Guid.Parse(User.FindFirstValue("sub") ?? throw new UnauthorizedAccessException());
    public bool HasPermission(string p) => User.HasClaim("permission", p);
}

[Authorize(Roles = "Admin")]                         // только Admin
[Authorize(Roles = "Admin,Manager")]                 // Admin ИЛИ Manager
[Authorize(Roles = "Admin")] [Authorize(Roles = "Auditor")]   // Admin И Auditor
public class ReportsController : ControllerBase { }

builder.Services.AddAuthorizationBuilder()
    .AddPolicy("AdultsOnly", p => p.RequireAssertion(ctx =>
        int.TryParse(ctx.User.FindFirstValue("age"), out var age) && age >= 18))
    .AddPolicy("SalesDepartment", p => p.RequireClaim("department", "Sales"))
    .AddPolicy("CanRefund", p => p
        .RequireAuthenticatedUser()
        .RequireClaim("permission", "orders.refund")
        .AddRequirements(new WorkingHoursRequirement(9, 18)));

builder.Services.AddSingleton<IAuthorizationHandler, WorkingHoursHandler>();

public sealed record WorkingHoursRequirement(int From, int To) : IAuthorizationRequirement;

public sealed class WorkingHoursHandler(TimeProvider clock) : AuthorizationHandler<WorkingHoursRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext ctx, WorkingHoursRequirement req)
    {
        var hour = clock.GetLocalNow().Hour;
        if (hour >= req.From && hour < req.To)
            ctx.Succeed(req);                  // требование выполнено
        return Task.CompletedTask;             // не вызвали Succeed — требование не выполнено
    }
}

public sealed class DocumentOwnerHandler : AuthorizationHandler<OperationAuthorizationRequirement, Document>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext ctx,
        OperationAuthorizationRequirement op, Document doc)
    {
        var userId = ctx.User.FindFirstValue("sub");
        if (op.Name == "Edit" && doc.AuthorId.ToString() == userId) ctx.Succeed(op);
        if (ctx.User.IsInRole("Admin")) ctx.Succeed(op);
        return Task.CompletedTask;
    }
}

// В обработчике запроса
app.MapPut("/documents/{id}", async (Guid id, UpdateDoc body, IAuthorizationService auth, ClaimsPrincipal user, AppDbContext db) =>
{
    var doc = await db.Documents.FindAsync(id);
    if (doc is null) return Results.NotFound();

    var result = await auth.AuthorizeAsync(user, doc, new OperationAuthorizationRequirement { Name = "Edit" });
    if (!result.Succeeded) return Results.Forbid();

    doc.Update(body.Title, body.Content);
    await db.SaveChangesAsync();
    return Results.NoContent();
});

// Обогатить пользователя правами из своей БД после аутентификации
public sealed class PermissionsTransformation(IPermissionStore store) : IClaimsTransformation
{
    public async Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)
    {
        if (principal.HasClaim(c => c.Type == "permission")) return principal;   // может вызываться несколько раз
        var id = principal.FindFirstValue("sub");
        if (id is null) return principal;
        var identity = new ClaimsIdentity();
        foreach (var p in await store.GetPermissionsAsync(id))
            identity.AddClaim(new Claim("permission", p));
        principal.AddIdentity(identity);
        return principal;
    }
}