Hardened API and catered for Partner role query filter bypass

PostFundManagement.Application/Filters/UserRoleFilter.cs

@@ -0,0 +1,25 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using static PostFundManagement.Domain.Extensions.Constants;
+
+namespace PostFundManagement.Application.Filters;
+
+public sealed class UserRoleFilter(ITenantContextService tenantContext) : IEndpointFilter
+{
+    public async ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
+    {
+        var principal = context.HttpContext.User;
+
+        var (roleDecoded, role) = principal.GetUserRole();
+
+        if (!roleDecoded)
+            return Results.Json(new { message = "Invalid/missing user role in token." }, statusCode: StatusCodes.Status401Unauthorized);
+
+        context.HttpContext.Items[UserRoleItemKey] = role;
+
+        if (role.Equals("Partner", StringComparison.InvariantCultureIgnoreCase))
+            tenantContext.ByPassTenantQueryFilter = true;
+
+        return await next(context);
+    }
+}