Hardened API and catered for Partner role query filter bypass

PostFundManagement.Application/Filters/ActiveUserFilter.cs

@@ -15,17 +15,13 @@ public sealed class ActiveUserFilter(IIdentityService identityService) : IEndpoi
 
         var (decoded, userId) = principal.GetUserId();
         var (emailDecoded, email) = principal.GetUserEmail();
-        var (roleDecoded, role) = principal.GetUserRole();
-
+        
         if (!decoded)
             return Results.Json(new { message = "Invalid user identifier in token." }, statusCode: StatusCodes.Status401Unauthorized);
 
         if (!emailDecoded)
             return Results.Json(new { message = "Invalid/missing user email in token." }, statusCode: StatusCodes.Status401Unauthorized);
 
-        if (!roleDecoded)
-            return Results.Json(new { message = "Invalid/missing user role in token." }, statusCode: StatusCodes.Status401Unauthorized);
-
         var path = context.HttpContext.Request.Path.Value;
 
         if (!string.IsNullOrWhiteSpace(path) && !path!.EndsWith("integration/sync", StringComparison.InvariantCultureIgnoreCase))
@@ -38,8 +34,7 @@ public sealed class ActiveUserFilter(IIdentityService identityService) : IEndpoi
 
         context.HttpContext.Items[UserIdItemKey] = userId;
         context.HttpContext.Items[EmailtemKey] = email;
-        context.HttpContext.Items[UserRoleItemKey] = role;
-
+        
         return await next(context);
     }
 }

PostFundManagement.Application/Filters/UserRoleFilter.cs

@@ -0,0 +1,25 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using static PostFundManagement.Domain.Extensions.Constants;
+
+namespace PostFundManagement.Application.Filters;
+
+public sealed class UserRoleFilter(ITenantContextService tenantContext) : IEndpointFilter
+{
+    public async ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
+    {
+        var principal = context.HttpContext.User;
+
+        var (roleDecoded, role) = principal.GetUserRole();
+
+        if (!roleDecoded)
+            return Results.Json(new { message = "Invalid/missing user role in token." }, statusCode: StatusCodes.Status401Unauthorized);
+
+        context.HttpContext.Items[UserRoleItemKey] = role;
+
+        if (role.Equals("Partner", StringComparison.InvariantCultureIgnoreCase))
+            tenantContext.ByPassTenantQueryFilter = true;
+
+        return await next(context);
+    }
+}