Summary
The role-check decision logic is implemented twice, once for commands and once for queries, with no shared source of truth.
Details
- `LibraryAuthorizeHandler` (src/Inshapardaz.Domain/Ports/Command/Library/LibraryAuthorizeHandler.cs)
- `LibraryAuthorizeDecorator<TQuery,TResult>` (src/Inshapardaz.Domain/Ports/Query/Library/LibraryAuthorizeDecorator.cs)
Both independently implement: super-admin bypass, "no roles specified = any authenticated user" fallback, and library-role matching.
Impact
A future fix to the authorization decision (e.g. tightening the "any authenticated user" fallback, or fixing an edge case) is easy to apply to one and miss in the other, silently reintroducing a gap.
Suggested fix
Extract the shared decision logic (given account, roles, library) into one helper both the command handler and query decorator call.
Summary
The role-check decision logic is implemented twice, once for commands and once for queries, with no shared source of truth.
Details
Both independently implement: super-admin bypass, "no roles specified = any authenticated user" fallback, and library-role matching.
Impact
A future fix to the authorization decision (e.g. tightening the "any authenticated user" fallback, or fixing an edge case) is easy to apply to one and miss in the other, silently reintroducing a gap.
Suggested fix
Extract the shared decision logic (given account, roles, library) into one helper both the command handler and query decorator call.