Enforce brewery ownership on update and delete (#267)

web/backend/Shared/Shared.Contracts/ClaimsPrincipalExtensions.cs

@@ -0,0 +1,21 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using Domain.Exceptions;
+
+namespace Shared.Contracts;
+
+/// <summary>Extension methods for reading well-known claims off an authenticated <see cref="ClaimsPrincipal" />.</summary>
+public static class ClaimsPrincipalExtensions
+{
+    /// <summary>
+    ///     Extracts the authenticated caller's user ID from the validated access token's <c>sub</c> claim.
+    /// </summary>
+    /// <exception cref="UnauthorizedException">Thrown when the claim is missing or malformed.</exception>
+    public static Guid GetAuthenticatedUserId(this ClaimsPrincipal user)
+    {
+        string? userIdClaim = user.FindFirst(JwtRegisteredClaimNames.Sub)?.Value;
+        if (!Guid.TryParse(userIdClaim, out Guid userId))
+            throw new UnauthorizedException("Access token is missing a valid user ID claim");
+        return userId;
+    }
+}

web/backend/Shared/Shared.Contracts/Shared.Contracts.csproj

@@ -5,4 +5,12 @@
         <Nullable>enable</Nullable>
         <RootNamespace>Shared.Contracts</RootNamespace>
     </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.2.1" />
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\Domain\Domain.Exceptions\Domain.Exceptions.csproj" />
+    </ItemGroup>
 </Project>