User Access API#

What groups / roles / modules the caller has. Sourced entirely from the JWT + legacy tables — no admin-only endpoint yet.

• Endpoint: GET /api/v1/users/me/access
• Auth: [Authorize] (any valid JWT)
• Jira: BFC-14
• ADR: 0005
• Legacy source: aspmnx_groupUsers, aspmnx_GroupRoles, aspnet_Roles, aspnet_Profile, MnxModule

Flow#

flowchart LR
    Req[GET /users/me/access] --> JWT[Extract sub claim]
    JWT --> Svc[UserAccessService]
    Svc --> G[aspmnx_groupUsers]
    Svc --> R[aspmnx_GroupRoles → aspnet_Roles]
    Svc --> M[MnxModule]
    Svc --> P[aspnet_Profile admin flags]
    G & R & M & P --> Merge[Merge into AccessDto]
    Merge --> Resp[200 { groups, roles, modules, adminFlags }]

Response shape#

{
  "success": true,
  "data": {
    "userId": "<guid>",
    "username": "compAdmin",
    "groups":  [{ "id": "<g>", "name": "..." }],
    "roles":   [{ "id": "<r>", "name": "SalesOrder.View" }],
    "modules": [{ "id": 1, "name": "SGA", "isPermission": true }],
    "adminFlags": {
      "companyAdmin": true, "acctAdmin": true, "prodAdmin": true,
      "scmAdmin": true, "crmAdmin": true, "engAdmin": true,
      "capaAdmin": false, "superUser": false,
      "projectsTasks": false, "isItarAuthorized": true
    }
  }
}

Rules#

• Scoped to caller only: no /users/{userId}/access path parameter — impossible to view another user’s access without admin tooling that doesn’t exist yet.
• Merges group + direct permissions: legacy stored proc aspmnx_GetRoles4UserModules is faithfully reproduced in LINQ.
• Follow-up BFC-33: an admin-only /users/{userId}/access route is planned but blocked on reviewer for cross-tenant guard design.