Stable user endpoints

Removed security deadlock

PostFundManagement.Application/Extensions/General.cs

@@ -23,20 +23,20 @@ public static class General
 
     public static (bool Decoded, Guid userId) GetUserId(this ClaimsPrincipal principal)
     {
-        var sidClaim = principal.FindFirst("sid")?.Value ?? principal.FindFirst(ClaimTypes.Sid)?.Value;
+        var subClaim = principal.FindFirst(JwtRegisteredClaimNames.Sub)?.Value ?? principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
 
-        var decoded = Guid.TryParse(sidClaim, out var userId);
+        var decoded = Guid.TryParse(subClaim, out var userId);
 
         return (decoded, userId);
     }
 
-    public static (bool Decoded, Guid email) GetUserEmail(this ClaimsPrincipal principal)
+    public static (bool Decoded, string email) GetUserEmail(this ClaimsPrincipal principal)
     {
         var emailClaim = principal.FindFirst("email")?.Value ?? principal.FindFirst(ClaimTypes.Email)?.Value;
 
-        var decoded = Guid.TryParse(emailClaim, out var email);
+        var decoded = !string.IsNullOrWhiteSpace(emailClaim);
 
-        return (decoded, email);
+        return (decoded, emailClaim!);
     }
 
     public static Microsoft.AspNetCore.Mvc.ProblemDetails ToProblems(this IReadOnlyList<IError> errors) => new()

PostFundManagement.Application/Extensions/Security.cs

@@ -135,17 +135,25 @@ public static class Security
         services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
             .AddJwtBearer(options =>
             {
+                options.MapInboundClaims = false;
                 options.Authority = authOptions.Authority;
                 options.Audience = authOptions.Audience;
+
                 options.TokenValidationParameters = new TokenValidationParameters
                 {
                     ValidIssuer = authOptions.Authority,
                     ValidateAudience = true,
                     ValidateIssuer = true,
+                    ValidateLifetime = true,
                 };
             });
 
-        services.AddAuthorization();
+        services.AddAuthorizationBuilder()
+            .AddPolicy("ApiScope", policy =>
+            {
+                policy.RequireAuthenticatedUser();
+                policy.RequireClaim("scope", authOptions.Audience!);
+            });
 
         return services;
     }

PostFundManagement.Application/Filters/ActiveUserFilter.cs

@@ -22,8 +22,11 @@ public sealed class ActiveUserFilter(IdentityService identityService) : IEndpoin
         if (!emailDecoded)
             return Results.Json(new { message = "Invalid/missing user email in token." }, statusCode: StatusCodes.Status400BadRequest);
 
-        if ((await identityService.UserIsAuthorisedAsync(userId, context.HttpContext.RequestAborted)).IsFailed)
-            return (object?)Results.Json(new { message = "Account approval is pending or inactive." }, statusCode: StatusCodes.Status403Forbidden);
+        var path = context.HttpContext.Request.Path.Value;
+
+        if (!string.IsNullOrWhiteSpace(path) && !path!.EndsWith("integration/sync", StringComparison.InvariantCultureIgnoreCase))
+            if ((await identityService.UserIsAuthorisedAsync(userId, context.HttpContext.RequestAborted)).IsFailed)
+                return (object?)Results.Json(new { message = "Account approval is pending or inactive." }, statusCode: StatusCodes.Status403Forbidden);
 
         context.HttpContext.Items[UserIdItemKey] = userId;
         context.HttpContext.Items[EmailtemKey] = email;

PostFundManagement.Application/PostFundManagement.Application.csproj

@@ -26,6 +26,7 @@
 
   <!-- Shared Usings -->
   <ItemGroup>
+    <Using Include="System.IdentityModel.Tokens.Jwt" />
     <Using Include="Asp.Versioning" />
     <Using Include="System.Security.Claims" />
     <Using Include="System.Diagnostics" />