fix(auth): support Auth0 role claim namespace variations#15
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Updates Auth0 role-claim handling so the app can recognize roles from varying Auth0 namespaces (not just the previously configured one), restoring correct admin-role behavior in Profile and Blazor AuthorizeView.
Changes:
- Added role-claim type inference in
RoleClaimsHelperby treating any claim type whose tail segment isrole/rolesas a role claim. - Updated Web configuration to include the production Auth0 roles namespace.
- Expanded unit test coverage to validate namespaced claim inference and updated Profile-related tests to use the production namespace.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/Unit.Tests/Security/RoleClaimsHelperTests.cs | Adds coverage for IsRoleClaimType and verifies inference/normalization across namespaced role claim types. |
| tests/Unit.Tests/Features/UserManagement/ProfileTests.cs | Updates test principal to emit roles using the production namespace claim type. |
| src/Web/appsettings.json | Adds https://articlesite.com/roles to configured Auth0:RoleClaimTypes. |
| src/Web/Security/RoleClaimsHelper.cs | Implements role-claim namespace inference and uses it for AddRoleClaims and GetRoles. |
| .squad/decisions/inbox/boromir-pr12-followups.md | Removes an inbox decision file that is now consolidated elsewhere. |
| .squad/decisions.md | Adds documentation describing the role-claim namespace inference decision (but currently duplicates an existing entry). |
| .squad/agents/ralph/history.md | Records orchestration/actions taken around prior PR thread resolution and merge. |
| .squad/agents/legolas/history.md | Records frontend validation of the admin-role UI behavior after the fix. |
| .squad/agents/gandalf/history.md | Records security review notes from prior PR work. |
| .squad/agents/frodo/history.md | Records security-side implementation summary for role claim normalization. |
| .squad/agents/boromir/history.md | Records ruleset/merge-blocker findings and post-merge sync procedures from prior PRs. |
…ations - Add IsRoleClaimType() to detect role claims ending with 'role' or 'roles' - GetEffectiveRoleClaimTypes() now infers namespaced role claims from identity - AddRoleClaims() and GetRoles() use inferred claim types automatically - appsettings.json includes production Auth0 namespace - Tests cover Auth0 namespace variations and inference logic Fixes #13: Profile.razor and NavMenu now display admin role correctly even when Auth0 uses different namespace Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
mpaulosky
force-pushed
the
squad/13-boromir-merge-notes
branch
from
April 19, 2026 01:58
1629eef to
de754c3
Compare
Contributor
SummarySummary
CoverageAppHost - 0%
Domain - 93.4%
ServiceDefaults - 0%
Web - 69.5%
|
Contributor
|
mpaulosky
added a commit
that referenced
this pull request
Apr 19, 2026
…asset manifest - Merged 4 decisions from inbox into .squad/decisions.md: - Decision #12: Merged-Branch Guard — guidance-only, defer automation - Decision #13: Release Guidance Fit for MyBlog - Decision #14: Delete non-fit imported assets - (Decision #15 reflected via DELETED-ASSETS.md manifest) - Updated agent histories with Milestone 3 coordination summary: - Aragorn: Release guidance finalized & asset disposition approved - Boromir: Merged-branch guard evidence review & secondary skills sync - Pippin: Deleted-assets manifest publication - Published .squad/decisions/DELETED-ASSETS.md as canonical reference for future contributors (post-build-validation, static-config-pattern, building-protection, release-process-base, release-issuetracker) - Confirmed asset disposition: - Deleted: 5 non-fit skills/playbooks - Retained: microsoft-code-reference (rewrite queued, backlog) - Active: release-process (MyBlog-specific routing) - Removed merged inbox files (4x decision submissions) - Milestone 3 roadmap complete; Sprint 3 cleanup ready for execution Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Fixes admin role display in Profile and NavMenu when Auth0 uses production namespace.
Changes
roleorroleshttps://articlesite.com/rolesTechnical Details
Auth0 exposes roles under
https://articlesite.com/rolesin production, but the app only recognizedhttps://myblog/roles. Now the app automatically detects any claim type ending in 'role' or 'roles' and treats it as a role claim.Verification