feat(authorization): add permission evaluator

Directory.Packages.props

@@ -36,6 +36,10 @@
 
     <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
 
+    <PackageVersion Include="xunit" Version="2.9.3" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+
   </ItemGroup>
 
 </Project>

OpenHealthOS.slnx

@@ -28,4 +28,8 @@
   <Folder Name="/src/Gateway/">
     <Project Path="src/Gateway/OpenHealthOS.Gateway.csproj" />
   </Folder>
+  <Folder Name="/tests/" />
+  <Folder Name="/tests/UnitTests/">
+    <Project Path="tests/UnitTests/OpenHealthOS.UnitTests.csproj" />
+  </Folder>
 </Solution>

src/BuildingBlocks/Security/Authorization/PermissionEvaluator.cs

@@ -0,0 +1,33 @@
+namespace OpenHealthOS.Security.Authorization;
+
+using OpenHealthOS.Contracts.Authorization;
+
+/// <summary>
+/// Evaluates authorization permissions using the scopes
+/// associated with the authenticated identity.
+/// </summary>
+public sealed class PermissionEvaluator : IAuthorizationEvaluator
+{
+    /// <summary>
+    /// Evaluates whether the requested permission is granted.
+    /// </summary>
+    /// <param name="context">
+    /// The authorization context to evaluate.
+    /// </param>
+    /// <returns>
+    /// <see cref="AuthorizationDecision.Allow"/> when the permission is
+    /// granted; otherwise <see cref="AuthorizationDecision.Deny"/>.
+    /// </returns>
+    public AuthorizationDecision Evaluate(AuthorizationContextDto context)
+    {
+        ArgumentNullException.ThrowIfNull(context);
+
+        var permission = context.Permission.Value;
+
+        return context.Identity.Scopes.Contains(
+            permission,
+            StringComparer.OrdinalIgnoreCase)
+            ? AuthorizationDecision.Allow
+            : AuthorizationDecision.Deny;
+    }
+}

tests/UnitTests/Authorization/PermissionEvaluatorTests.cs

@@ -0,0 +1,87 @@
+namespace OpenHealthOS.UnitTests.Authorization;
+
+using OpenHealthOS.Contracts.Authorization;
+using OpenHealthOS.Contracts.Identity;
+using OpenHealthOS.Security.Authorization;
+using Xunit;
+
+public sealed class PermissionEvaluatorTests
+{
+    private readonly PermissionEvaluator _evaluator = new();
+
+    [Fact]
+    public void Evaluate_ShouldThrow_WhenContextIsNull()
+    {
+        var action = () => { _evaluator.Evaluate(null!); };
+
+        Assert.Throws<ArgumentNullException>(action);
+    }
+
+    [Fact]
+    public void Evaluate_ShouldAllow_WhenPermissionExistsInScopes()
+    {
+        var context = CreateContext(
+            scopes: ["patient.read"]);
+
+        var result = _evaluator.Evaluate(context);
+
+        Assert.Equal(
+            AuthorizationDecision.Allow,
+            result);
+    }
+
+    [Fact]
+    public void Evaluate_ShouldDeny_WhenPermissionIsNotGranted()
+    {
+        var context = CreateContext(
+            scopes: ["patient.write"]);
+
+        var result = _evaluator.Evaluate(context);
+
+        Assert.Equal(
+            AuthorizationDecision.Deny,
+            result);
+    }
+
+    [Fact]
+    public void Evaluate_ShouldDeny_WhenIdentityHasNoPermissions()
+    {
+        var context = CreateContext();
+
+        var result = _evaluator.Evaluate(context);
+
+        Assert.Equal(
+            AuthorizationDecision.Deny,
+            result);
+    }
+
+    [Fact]
+    public void Evaluate_ShouldBeCaseInsensitive()
+    {
+        var context = CreateContext(
+            scopes: ["PATIENT.READ"]);
+
+        var result = _evaluator.Evaluate(context);
+
+        Assert.Equal(
+            AuthorizationDecision.Allow,
+            result);
+    }
+
+    private static AuthorizationContextDto CreateContext(
+    IReadOnlyCollection<string>? scopes = null)
+    {
+        return new AuthorizationContextDto
+        {
+            Identity = new IdentityContextDto
+            {
+                SubjectId = "test-user",
+                PrincipalType = PrincipalType.User,
+                Scopes = scopes ?? Array.Empty<string>(),
+                Roles = Array.Empty<string>(),
+            },
+            Permission = new Permission("patient.read"),
+            ResourceType = "Patient",
+        };
+    }
+}

tests/UnitTests/OpenHealthOS.UnitTests.csproj

@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="xunit" />
+    <PackageReference Include="xunit.runner.visualstudio" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\BuildingBlocks\Security\OpenHealthOS.Security.csproj" />
+  </ItemGroup>
+
+</Project>