The Moderator role identifies authenticated callers allowed to perform designated update operations. In the board-game API, role checks are added to controller actions and gRPC methods with the ASP.NET Core [Authorize] attribute. section 9.4.5 section 10.3.6
Apply the role consistently across the API:
- Restrict board-game, domain, and mechanic update actions with [Authorize(Roles = RoleNames.Moderator)]. section 9.4.5
- Protect gRPC update methods, such as UpdateBoardGame, with the same role requirement. section 10.3.6
- Pass the bearer token through the gRPC controller wrapper so the server can evaluate the caller’s role. section 10.3.6
Verifying access
Authenticate as TestUser, TestModerator, and TestAdministrator in SwaggerUI. TestUser receives 401 responses for moderator and administrator endpoints; TestModerator receives 200 for the moderator endpoint and 401 for the administrator endpoint; TestAdministrator receives 200 for both. section 9.4.6
Listing 10.10 /gRPC/GrpcService.cs file: UpdateBoardGame method
using Microsoft.AspNetCore.Authorization; #1
using MyBGList.Constants; #1
// ... existing code
[Authorize(Roles = RoleNames.Moderator)] #2
public override async Task<BoardGameResponse> UpdateBoardGame(
UpdateBoardGameRequest request,
ServerCallContext scc)
{
var bg = await _context.BoardGames
.Where(bg => bg.Id == request.Id)
.FirstOrDefaultAsync();
var response = new BoardGameResponse();
if (bg != null)
{
bg.Name = request.Name;
_context.BoardGames.Update(bg);
await _context.SaveChangesAsync();
response.Id = bg.Id;
response.Name = bg.Name;
response.Year = bg.Year;
}
return response;
}
The protected UpdateBoardGame implementation shows the role attribute alongside the update and persistence logic. section 10.3.6
