Core.Portal.SignIn

Core.Portal.SignIn contains product-agnostic helpers for broker-backed portal sign-in.

The package calls the Core auth API through Core.Api.Clients.AuthApiClient, validates the returned JWT, enforces configured roles, and returns a cookie-ready ClaimsPrincipal. Product portals still own login pages, branding, antiforgery, redirects, cookie scheme names, SmartScheme routing, and tenant-specific configuration.

Email-first portal flows use ICorePortalAuthDiscoveryService.DiscoverAsync(...) before asking for a password. The service calls POST /api/core/auth/discover with email, app/surface/principal context, and optional tenant hints. Core resolves a tenant from explicit hints, API-key context, a known identity user, or configured SSO email domains, then returns one of:

• redirect: start the returned NextProviderKey through /api/core/auth/start.
• choice: show the returned interactive providers.
• password: reveal the product-owned password form.
• needs_tenant_hint: use a direct tenant link or another tenant-safe hint; do not show a tenant picker by default.

This package must not reference persistence, API controllers, workers, or product repos.

Example

builder.Services.AddCorePortalSignIn(builder.Configuration, options =>
{
    options.CoreApiBaseUrl = "https://api.example.com/";
    options.TenantApiKey = builder.Configuration["Portal:TenantApiKey"];
    options.RequiredRoles.Add(RoleCodes.PlatformSuperuser);
    options.CookieAuthenticationScheme = "ProductPortal.Cookies";
});

The product login page or controller calls ICorePortalSignInService.TryCreatePrincipalAsync(...), then performs SignInAsync(...) with its own cookie scheme and redirect flow.