Deep clean: stop reading password hash, fail-fast config, dependency hygiene

.github/workflows/ci.yml

@@ -2,11 +2,13 @@ name: CI
 
 on:
   push:
-    branches-ignore: []          # build every branch push
   pull_request:
     branches: [ "main" ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # Cancel superseded runs on the same ref to save minutes.
 concurrency:
   group: ci-${{ github.ref }}

Authorization.sln

@@ -7,8 +7,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{827E0CD3-B72
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Authorization.Abstractions", "src\Authorization.Abstractions\Authorization.Abstractions.csproj", "{60BA81F8-B279-47E3-8786-6FAE86C81FD3}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Authorization.Common", "src\Authorization.Common\Authorization.Common.csproj", "{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}"
-EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Authorization.DataAccess", "src\Authorization.DataAccess\Authorization.DataAccess.csproj", "{03B4B2E4-7A31-44B1-87B4-3A939DAD29E0}"
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Authorization.Business", "src\Authorization.Business\Authorization.Business.csproj", "{8B921C4E-CCBD-49DE-91F8-0955695BC2D7}"
@@ -39,18 +37,6 @@ Global
 		{60BA81F8-B279-47E3-8786-6FAE86C81FD3}.Release|x64.Build.0 = Release|Any CPU
 		{60BA81F8-B279-47E3-8786-6FAE86C81FD3}.Release|x86.ActiveCfg = Release|Any CPU
 		{60BA81F8-B279-47E3-8786-6FAE86C81FD3}.Release|x86.Build.0 = Release|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Debug|x64.Build.0 = Debug|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Debug|x86.Build.0 = Debug|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Release|Any CPU.Build.0 = Release|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Release|x64.ActiveCfg = Release|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Release|x64.Build.0 = Release|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Release|x86.ActiveCfg = Release|Any CPU
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699}.Release|x86.Build.0 = Release|Any CPU
 		{03B4B2E4-7A31-44B1-87B4-3A939DAD29E0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{03B4B2E4-7A31-44B1-87B4-3A939DAD29E0}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{03B4B2E4-7A31-44B1-87B4-3A939DAD29E0}.Debug|x64.ActiveCfg = Debug|Any CPU
@@ -105,7 +91,6 @@ Global
 	EndGlobalSection
 	GlobalSection(NestedProjects) = preSolution
 		{60BA81F8-B279-47E3-8786-6FAE86C81FD3} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
-		{E8AF7B80-0A65-45E5-8F73-357A0FFFF699} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
 		{03B4B2E4-7A31-44B1-87B4-3A939DAD29E0} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
 		{8B921C4E-CCBD-49DE-91F8-0955695BC2D7} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
 		{C3F978CB-98CB-46B9-82FB-D795B1D76DA4} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}

README.md

@@ -16,7 +16,7 @@ Once a request has been authenticated (by JWT bearer auth, for example), the mid
 
 1. Reads the configured user-name claim from the incoming principal.
 2. Looks up the matching user in the security database (via a stored procedure).
-3. Adds `Email`, `Name` and `IdUsuario` claims.
+3. Adds `Email`, `Name` and `IdUsuario` (`ClaimsEnrichmentMiddleware.UserIdClaimType`) claims.
 4. Looks up the user's profiles and adds a `Role` claim for each one.
 
 If anything goes wrong resolving that data (missing claim, unknown user, database outage), the request **degrades gracefully**: it continues unenriched instead of crashing the pipeline.
@@ -29,9 +29,8 @@ The solution is layered so each concern is isolated and independently testable:
 
 | Project | Responsibility |
 | --- | --- |
-| `Authorization.Abstractions` | Contracts: entities, models, options and interfaces. No external dependencies. |
-| `Authorization.Common` | Cached, reflection-based object mapper used to map entities → models. |
-| `Authorization.DataAccess` | Dapper + `Microsoft.Data.SqlClient` access to stored procedures. |
+| `Authorization.Abstractions` | Contracts: models, options and interfaces. No external dependencies. |
+| `Authorization.DataAccess` | Dapper + `Microsoft.Data.SqlClient` access to stored procedures; maps database rows to models. |
 | `Authorization.Business` | Thin business layer orchestrating identity resolution. |
 | `Authorization.Middleware` | The ASP.NET Core middleware plus DI and pipeline extensions. |
 
@@ -92,7 +91,7 @@ app.UseAuthorization();
 
 ## ⚙️ Configuration
 
-Everything that used to be hard-coded is now configurable through `ClaimsEnrichmentOptions`:
+Claim and database settings are configurable through `ClaimsEnrichmentOptions`. They are validated at startup, so a missing connection string or blank setting fails the host instead of individual requests.
 
 ```csharp
 builder.Services.AddAuthorizationClaims(options =>

src/Authorization.Abstractions/Authorization.Abstractions.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <PackageId>Authorization.Abstractions</PackageId>
-    <Description>Contracts (entities, models, options and interfaces) for the JWT authorization middleware. Has no external dependencies.</Description>
+    <Description>Contracts (models, options and interfaces) for the JWT authorization middleware. Has no external dependencies.</Description>
   </PropertyGroup>
 
 </Project>

src/Authorization.Abstractions/Models/User.cs

@@ -2,8 +2,6 @@ namespace Authorization.Abstractions.Models;
 
 /// <summary>
 /// Domain model of a user, used by the business and middleware layers.
-/// Kept separate from the database entity so persistence changes never leak
-/// into the pipeline contract.
 /// </summary>
 public sealed class User
 {
@@ -13,9 +11,6 @@ public sealed class User
     /// <summary>Login name of the user.</summary>
     public string? UserName { get; set; }
 
-    /// <summary>Hashed password. Never surfaced in claims, logs or responses.</summary>
-    public string? PasswordHash { get; set; }
-
     /// <summary>Email address of the user.</summary>
     public string? Email { get; set; }
 }

src/Authorization.Abstractions/Options/ClaimsEnrichmentOptions.cs

@@ -2,9 +2,6 @@ namespace Authorization.Abstractions.Options;
 
 /// <summary>
 /// Configuration for the claims-enrichment middleware and the security store.
-/// Everything that used to be hard-coded (the inbound claim to read the user
-/// name from, and the stored-procedure names) is configurable here so the
-/// package can be reused without recompiling.
 /// </summary>
 public sealed class ClaimsEnrichmentOptions
 {
@@ -16,19 +13,19 @@ public sealed class ClaimsEnrichmentOptions
 
     /// <summary>
     /// The inbound JWT claim type that carries the user name used to look the
-    /// user up. Defaults to <c>usuario</c> to preserve the historical contract.
+    /// user up. Defaults to <c>usuario</c>.
     /// </summary>
     public string UserNameClaimType { get; set; } = "usuario";
 
     /// <summary>
     /// Stored procedure that returns a single user by user name / email.
-    /// Defaults to <c>ObtenerUsuario</c> (the existing database object name).
+    /// Defaults to <c>ObtenerUsuario</c>.
     /// </summary>
     public string GetUserProcedure { get; set; } = "ObtenerUsuario";
 
     /// <summary>
     /// Stored procedure that returns the profiles for a user.
-    /// Defaults to <c>ObtenerPerfilesxUsuario</c> (the existing database object name).
+    /// Defaults to <c>ObtenerPerfilesxUsuario</c>.
     /// </summary>
     public string GetProfilesProcedure { get; set; } = "ObtenerPerfilesxUsuario";
 }

src/Authorization.DataAccess/Authorization.DataAccess.csproj

@@ -14,7 +14,6 @@
 
   <ItemGroup>
     <ProjectReference Include="..\Authorization.Abstractions\Authorization.Abstractions.csproj" />
-    <ProjectReference Include="..\Authorization.Common\Authorization.Common.csproj" />
   </ItemGroup>
 
 </Project>

src/Authorization.DataAccess/Entities/Profile.cs

@@ -0,0 +1,8 @@
+namespace Authorization.DataAccess.Entities;
+
+internal sealed class Profile
+{
+    public int Id { get; set; }
+
+    public string? Name { get; set; }
+}

src/Authorization.DataAccess/Entities/User.cs

@@ -0,0 +1,13 @@
+namespace Authorization.DataAccess.Entities;
+
+// Row shape returned by the user stored procedure. Columns without a matching
+// property (e.g. the password hash) are ignored by Dapper, so secrets are never
+// materialized in memory.
+internal sealed class User
+{
+    public Guid Id { get; set; }
+
+    public string? UserName { get; set; }
+
+    public string? Email { get; set; }
+}