النطاقات (Scopes) والمطالبات (Claims) وتصميم التفويض

في هذا الدرس

design fine-grained authorization.

الموضوعات المخطط لها

• Scopes describe what a client may do (orders:read, inventory:write); claims describe who the user is (subject, roles, tenant).
• Authorization has layers: scope (may this client call this API?), role (may this user do this kind of action?), and ownership or attribute checks (is this their order?).
• Keep tokens small; put stable facts in claims, look up changing permissions in the service.
• Least privilege: admin operations need their own scope.
• Test authorization as code (negative tests).