auth-patterns

Call the existing GetPlatformUserId extension, which tries sub, then nameidentifier, then sid, then internal_user_id, accepting only GUID-parseable values. Use GetRequiredPlatformUserId when a missing identifier should throw UnauthorizedAccessException instead of returning null.

Validate issuer, audience, and lifetime with a five-minute clock skew, and accept the token when either aud or azp matches an allowed client such as islamu-event-api or islamu-event-blazor. Validating only aud or only azp lets unauthorized clients present otherwise valid tokens.

Storing tokens in localStorage or sessionStorage bypasses the BFF boundary and exposes them to browser-side attacks. The BFF keeps tokens in HttpOnly cookies and forwards a Bearer token to the API, so the browser never sees them.

No, UI action gating must use the HAL _links returned by the server, which are produced by the Candidate, Normalize, Batch, and Materialize pipeline and fail closed. Role or claim inspection on the client drifts from the server authorization contract.

ATProto DIDs and Google subjects are not GUIDs, so the claim chain returns null unless internal_user_id is present. Resolve the linked local account with mediator.ResolveCurrentUserIdAsync instead of writing a fallback extraction helper.