feat(contracts): add authorization contracts

src/BuildingBlocks/Contracts/Authorization/AuthorizationContextDto.cs

@@ -0,0 +1,39 @@
+namespace OpenHealthOS.Contracts.Authorization;
+
+using OpenHealthOS.Contracts.Identity;
+
+/// <summary>
+/// Represents the information required to evaluate an authorization request.
+/// </summary>
+public sealed record AuthorizationContextDto
+{
+    /// <summary>
+    /// Gets the authenticated identity associated with the request.
+    /// </summary>
+    public required IdentityContextDto Identity { get; init; }
+
+    /// <summary>
+    /// Gets the permission being requested.
+    /// </summary>
+    public required Permission Permission { get; init; }
+
+    /// <summary>
+    /// Gets the resource type against which authorization is evaluated.
+    /// </summary>
+    public required string ResourceType { get; init; }
+
+    /// <summary>
+    /// Gets the optional resource identifier.
+    /// </summary>
+    public string? ResourceId { get; init; }
+
+    /// <summary>
+    /// Gets the optional tenant identifier associated with the resource.
+    /// </summary>
+    public string? TenantId { get; init; }
+
+    /// <summary>
+    /// Gets the optional organization identifier associated with the resource.
+    /// </summary>
+    public string? OrganizationId { get; init; }
+}

src/BuildingBlocks/Contracts/Authorization/AuthorizationDecision.cs

@@ -0,0 +1,17 @@
+namespace OpenHealthOS.Contracts.Authorization;
+
+/// <summary>
+/// Represents the outcome of an authorization evaluation.
+/// </summary>
+public enum AuthorizationDecision
+{
+    /// <summary>
+    /// Access is allowed.
+    /// </summary>
+    Allow = 1,
+
+    /// <summary>
+    /// Access is denied.
+    /// </summary>
+    Deny = 2,
+}

src/BuildingBlocks/Contracts/Authorization/Permission.cs

@@ -0,0 +1,34 @@
+namespace OpenHealthOS.Contracts.Authorization;
+
+/// <summary>
+/// Represents a named authorization permission.
+/// </summary>
+public sealed record Permission
+{
+    /// <summary>
+    /// Initializes a new instance of the <see cref="Permission"/> class.
+    /// </summary>
+    /// <param name="value">The stable permission identifier.</param>
+    public Permission(string value)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            throw new ArgumentException(
+                "Permission value cannot be null or whitespace.",
+                nameof(value));
+        }
+
+        Value = value;
+    }
+
+    /// <summary>
+    /// Gets the stable permission identifier.
+    /// </summary>
+    public string Value { get; }
+
+    /// <summary>
+    /// Returns the permission identifier.
+    /// </summary>
+    /// <returns>The permission identifier string.</returns>
+    public override string ToString() => Value;
+}