Role-Based, Policy-Based & Claims-Based Security

using System;
using System.Collections.Generic;

// Authentication = WHO are you?   (proving identity)
// Authorization  = WHAT may you do? (deciding access)
// They are two separate steps. You authenticate FIRST, then authorize.

class User
{
    public string Name { get; }
    public bool IsAuthenticated { get; }   // set by the login/authn step
    public List<string> Roles { get; }     // assigned to the identity

    public User(string name, bool isAuthenticated, List<string> roles)
    {
 
...

using System;
using System.Collections.Generic;

class User
{
    public string Name { get; }
    public List<string> Roles { get; }
    public User(string name, List<string> roles) { Name = name; Roles = roles; }
}

class Program
{
    static void Main()
    {
        // 🎯 YOUR TURN — authorize by ROLE. Fill in each ___ then run it.

        var user = new User("Bob", new List<string> { "Manager", "Admin" });

        // 1) Bob is authorized only if his Roles list CONTAINS "Admin".
        boo
...

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

// In ASP.NET Core the framework does the role check FOR you, declaratively,
// with the [Authorize] attribute. No 'if (Roles.Contains(...))' in your code.
[ApiController]
[Route("api/[controller]")]
public class AdminController : ControllerBase
{
    // Only an authenticated user whose identity has the "Admin" role gets in.
    [HttpGet("dashboard")]
    [Authorize(Roles = "Admin")]
    public IActionResult GetDashboard(
...

using System;
using System.Collections.Generic;
using System.Linq;

// A CLAIM is a single fact about a user: a (type, value) pair.
// "name" = "Alice",  "age" = "21",  "email_verified" = "true".
// Claims-based authorization decides access by the FACTS, not by a role label.

class Program
{
    static void Main()
    {
        // The identity is just a bag of claims (type, value).
        var claims = new List<(string Type, string Value)>
        {
            ("name", "Alice"),
            ("a
...

using System;
using System.Collections.Generic;
using System.Linq;

class Program
{
    static void Main()
    {
        // 🎯 YOUR TURN — authorize by a CLAIM, not a role. Fill in each ___.

        var claims = new List<(string Type, string Value)>
        {
            ("name", "Sam"),
            ("age", "16")
        };

        // 1) Pull out the value of the "age" claim by its Type.
        var ageClaim = claims.FirstOrDefault(c => c.Type == ___);  // 👉 "age" (in quotes)

        // 2) T
...

using System;
using System.Security.Claims;
using Microsoft.AspNetCore.Authorization;

// A POLICY bundles one or more requirements behind a name you reuse everywhere.
// Register them once at startup, then refer to them by name on endpoints.
var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthorization(options =>
{
    // Claims-based policy: the identity must carry email_verified = "true".
    options.AddPolicy("EmailVerified", policy =>
        policy.RequireClaim("emai
...