Enforce brewery ownership on update and delete (#267)

web/backend/Shared/Shared.Contracts/ClaimsPrincipalExtensions.cs

@@ -0,0 +1,21 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using Domain.Exceptions;
+
+namespace Shared.Contracts;
+
+/// <summary>Extension methods for reading well-known claims off an authenticated <see cref="ClaimsPrincipal" />.</summary>
+public static class ClaimsPrincipalExtensions
+{
+    /// <summary>
+    ///     Extracts the authenticated caller's user ID from the validated access token's <c>sub</c> claim.
+    /// </summary>
+    /// <exception cref="UnauthorizedException">Thrown when the claim is missing or malformed.</exception>
+    public static Guid GetAuthenticatedUserId(this ClaimsPrincipal user)
+    {
+        string? userIdClaim = user.FindFirst(JwtRegisteredClaimNames.Sub)?.Value;
+        if (!Guid.TryParse(userIdClaim, out Guid userId))
+            throw new UnauthorizedException("Access token is missing a valid user ID claim");
+        return userId;
+    }
+}