Interface IStateAllowlist

Namespace

SEBT.Portal.Api.Services

Assembly

SEBT.Portal.Api.dll

Server-side allowlist of state codes permitted to use the OIDC login endpoints. Derived at startup from per-state appsettings overlays that have Oidc:DiscoveryEndpoint configured; an instance loaded with STATE=co and CO's Oidc block exposes {"co"}, nothing else. Any stateCode in a route or request body that isn't in this set is rejected before the OIDC flow touches PingOne, blocking attempts to use an instance as an unintended tenant.

public interface IStateAllowlist

Properties

All

Lowercased, case-insensitive set of allowed state codes.

IReadOnlySet<string> All { get; }

Property Value

IReadOnlySet<string>

Methods

Contains(string?)

True if stateCode (case-insensitive) is a configured OIDC tenant.

bool Contains(string? stateCode)

Parameters

stateCode string

Returns

bool

TryResolve(string?)

Resolves a user-provided stateCode to the canonical (lowercased) value from the allowlist. Returns null if not found. The returned value is from the allowlist itself, not derived from user input — safe for logging and downstream use without taint.

string? TryResolve(string? stateCode)

Parameters

stateCode string

Returns

string