Stable user endpoints

Removed security deadlock

PostFundManagement.Application/Extensions/General.cs

@@ -23,20 +23,20 @@ public static class General
 
     public static (bool Decoded, Guid userId) GetUserId(this ClaimsPrincipal principal)
     {
-        var sidClaim = principal.FindFirst("sid")?.Value ?? principal.FindFirst(ClaimTypes.Sid)?.Value;
+        var subClaim = principal.FindFirst(JwtRegisteredClaimNames.Sub)?.Value ?? principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
 
-        var decoded = Guid.TryParse(sidClaim, out var userId);
+        var decoded = Guid.TryParse(subClaim, out var userId);
 
         return (decoded, userId);
     }
 
-    public static (bool Decoded, Guid email) GetUserEmail(this ClaimsPrincipal principal)
+    public static (bool Decoded, string email) GetUserEmail(this ClaimsPrincipal principal)
     {
         var emailClaim = principal.FindFirst("email")?.Value ?? principal.FindFirst(ClaimTypes.Email)?.Value;
 
-        var decoded = Guid.TryParse(emailClaim, out var email);
+        var decoded = !string.IsNullOrWhiteSpace(emailClaim);
 
-        return (decoded, email);
+        return (decoded, emailClaim!);
     }
 
     public static Microsoft.AspNetCore.Mvc.ProblemDetails ToProblems(this IReadOnlyList<IError> errors) => new()

PostFundManagement.Application/Extensions/Security.cs

@@ -135,17 +135,25 @@ public static class Security
         services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
             .AddJwtBearer(options =>
             {
+                options.MapInboundClaims = false;
                 options.Authority = authOptions.Authority;
                 options.Audience = authOptions.Audience;
+
                 options.TokenValidationParameters = new TokenValidationParameters
                 {
                     ValidIssuer = authOptions.Authority,
                     ValidateAudience = true,
                     ValidateIssuer = true,
+                    ValidateLifetime = true,
                 };
             });
 
-        services.AddAuthorization();
+        services.AddAuthorizationBuilder()
+            .AddPolicy("ApiScope", policy =>
+            {
+                policy.RequireAuthenticatedUser();
+                policy.RequireClaim("scope", authOptions.Audience!);
+            });
 
         return services;
     }