SharpAccess

SharpAccess is a Windows-only authentication and authorization package family for ASP.NET Core and .NET 10. It keeps security behavior in SharpAccess.Core and lets the host select exactly one supported relational persistence package.

It is designed for teams that want explicit security boundaries, deterministic migrations, bounded resource use, provider-neutral application code, exact-revision engineering evidence, and a small reviewed public API—without adopting an ORM, ASP.NET Identity, or a hidden application framework.

SharpAccess.Core is the primary node. The host selects one supported DB package; Core never references a concrete database client.

flowchart TB
    Core["SharpAccess.Core<br/>authentication · authorization · sessions · tokens · OIDC"]:::primary

    Host["ASP.NET Core host<br/>Windows · .NET 10"] --> Core
    Secrets["Host-owned secrets<br/>signing keys · peppers · token-hash keys"] --> Core
    External["OIDC and email services"] <--> Core

    Core -. provider-neutral contracts .-> Provider["One selected DB provider package<br/>connections · SQL · migrations · transactions"]
    Provider --> DB[("Database")]

    classDef primary fill:#512BD4,color:#fff,stroke:#2b176d,stroke-width:3px;

Install Core plus exactly one supported DB provider.

dotnet add package SharpAccess.Core --version 0.9.0-rc.1
dotnet add package SharpAccess.Sqlite --version 0.9.0-rc.1

dotnet add package SharpAccess.Core --version 0.9.0-rc.1
dotnet add package SharpAccess.Postgres --version 0.9.0-rc.1

WebApplicationBuilder builder = WebApplication.CreateBuilder(args);

builder.Services.AddSharpAccess(builder.Configuration, options =>
{
    options.Features.PasswordAuthentication = true;
    options.Features.Registration = true;
    options.Features.PasswordReset = true;
    options.Features.RefreshTokens = true;
});

// Choose exactly one:
builder.Services.AddSqliteAccess(builder.Configuration);
// builder.Services.AddPostgresAccess(builder.Configuration);

WebApplication app = builder.Build();

await app.Services.InitializeSharpAccessAsync(
    app.Lifetime.ApplicationStopping);

app.UseSharpAccessExceptionHandling();
app.UseSharpAccessSecurityHeaders();
app.UseSharpAccess();
app.MapSharpAccessEndpoints();

await app.RunAsync();

{
  "SharpAccess": {
    "BaseUri": "https://app.example.com",
    "JwtIssuer": "example-auth",
    "JwtAudience": "example-clients",
    "AccessTokenSigning": {
      "ActiveKeyId": "2026-08",
      "HmacSha256Keys": {
        "2026-08": {
          "Key": "<protected-secret>",
          "ActivatedUtc": "2026-08-01T00:00:00Z"
        }
      }
    },
    "TokenHashing": {
      "CurrentKeyVersion": "v1",
      "Keys": {
        "v1": "<protected-secret>"
      }
    },
    "Passwords": {
      "CurrentPepperVersion": "v1",
      "Peppers": {
        "v1": "<protected-secret>"
      }
    },
    "RateLimits": {
      "PartitionKey": "<dedicated-protected-secret>"
    },
    "Features": {
      "PasswordAuthentication": true,
      "Registration": true,
      "PasswordReset": true,
      "RefreshTokens": true,
      "Administration": false,
      "Tenancy": false
    }
  },
  "ConnectionStrings": {
    "Auth": "<host-owned DB connection string>"
  }
}

flowchart TD
    Request["Incoming request"] --> Token["Validate algorithm · kid · issuer · audience · lifetime · bounded claims"]
    Token --> Account["Recheck account state and security version"]
    Account --> Authz["Recheck authorization version"]
    Authz --> Scope{"Global or active tenant?"}
    Scope -->|Global| Global["Global roles and permissions"]
    Scope -->|Tenant| Tenant["Route-bound tenant roles, permissions, and owner"]
    Global --> Policy["Explicit endpoint policy"]
    Tenant --> Policy
    Policy --> Result["Allow or fail closed"]

The following block is generated from the exact release revision’s artifacts/quality-report/metrics.json. It must not be manually edited.

Source: exact-revision artifacts/quality-report/metrics.json · Schema: 2 · Enforcement: EvidenceOnly

For higher-is-better metrics such as coverage and maintainability, the table reports p95 and the minimum as the worst observed value. For adverse metrics such as CRAP, cyclomatic complexity, coupling, and instability, the worst value is the maximum. Critical mutation evidence is binary, so a percentile is not meaningful: every selected critical mutation must be killed, with zero infrastructure failures.

The complete report includes project, namespace, type, member, dependency, and hotspot views. See Quality and Metrics.

• Windows only.
• .NET 10 SDK selected by global.json.
• PowerShell 7 for repository automation.
• No Bash parity, Linux/macOS support claim, Dockerfile, Compose file, service container, or local container orchestration.
• External DB evidence uses native Windows tooling or an approved managed scratch DB.
• Hosts must validate their own deployment topology, availability, capacity, backups, monitoring, and disaster-recovery objectives.

The public repository begins with one signed root commit containing the exact tracked tree exported from an approved private development revision. It does not inherit private commits, branches, tags, notes, issues, pull-request refs, or Git objects.

Packages, symbols, SBOMs, checksums, provenance, the signed v0.9.0-rc.1 tag, and the GitHub prerelease are created only from the exact verified public release revision.

flowchart LR
    Dev["Approved private revision"] --> Export["Deterministic tracked-file export"]
    Export --> Root["Single signed public root"]
    Root --> Verify["Exact public-root release matrix"]
    Verify --> Tag["Signed v0.9.0-rc.1 tag"]
    Tag --> Core["Publish SharpAccess.Core"]
    Core --> Providers["Publish SharpAccess.Sqlite + SharpAccess.Postgres"]
    Providers --> Release["GitHub prerelease + post-publication smoke"]

SQL Server and MySQL remain roadmap candidates only. They are not active projects, packages, registrations, APIs, tests, workflows, or support commitments.

SharpAccess is licensed under the MIT License.