Build named role policies

Converts each consumer-declared AddPolicies(string policyName, params string[] roles) call into a named ASP.NET Core authorization policy containing one RoleRequirement per role.

Field	Value
Operation ID	OP-02
Trigger	First resolution of IOptions<AuthorizationOptions> (options framework)
Inputs	Framework AuthorizationOptions; consumer SetPolicies() override
Outputs	AuthorizationOptions populated with named policies
Primary components	ConfigureRoleAuthorizationOptions.Configure, AddPolicies
Entry point	src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Options/ConfigureRoleAuthorizationOptions.cs

Steps

1. Store the framework AuthorizationOptions in the AuthorizationOptions property.
2. Call the consumer's SetPolicies() override (abstract).
3. For each AddPolicies(string policyName, params string[] roles) call, create one RoleRequirement(role, AuthorizationService) per role. (BR-NTLM-012)
4. Call AuthorizationOptions.AddPolicy(policyName, policy => policy.AddRequirements(requirements)). (BR-NTLM-007)
5. A duplicate policyName is replaced or throws per the framework's own AuthorizationOptions.AddPolicy behavior; this library does not guard against it.

Process flow

flowchart TD
    Start([IOptions resolved]) --> S1[Consumer SetPolicies invoked]
    S1 --> S2[For each AddPolicies call]
    S2 --> S3[Create one RoleRequirement per role]
    S3 --> S4[AuthorizationOptions.AddPolicy with all requirements]
    S4 --> End([Named policy registered])

Failure and edge-case behavior

• Multi-role policies behave as AND, not OR, because every RoleRequirement must succeed (BR-NTLM-007).

Related documentation

• Operations and processes
• Business rules

Sources

• src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Options/ConfigureRoleAuthorizationOptions.cs