Class StateAllowlist

Namespace

SEBT.Portal.Api.Services

Assembly

SEBT.Portal.Api.dll

Server-side allowlist of state codes permitted to use the OIDC login endpoints. Derived at startup from per-state appsettings overlays that have Oidc:DiscoveryEndpoint configured; an instance loaded with STATE=co and CO's Oidc block exposes {"co"}, nothing else. Any stateCode in a route or request body that isn't in this set is rejected before the OIDC flow touches PingOne, blocking attempts to use an instance as an unintended tenant.

public sealed class StateAllowlist : IStateAllowlist

Inheritance

object

StateAllowlist

Implements

IStateAllowlist

Constructors

StateAllowlist(IEnumerable<string>)

Builds an allowlist from a lowercased, de-duplicated view of states.

public StateAllowlist(IEnumerable<string> states)

Parameters

states IEnumerable<string>

Properties

All

Lowercased, case-insensitive set of allowed state codes.

public IReadOnlySet<string> All { get; }

Property Value

IReadOnlySet<string>

Methods

Contains(string?)

True if stateCode (case-insensitive) is a configured OIDC tenant.

public bool Contains(string? stateCode)

Parameters

stateCode string

Returns

bool

TryResolve(string?)

Resolves a user-provided stateCode to the canonical (lowercased) value from the allowlist. Returns null if not found. The returned value is from the allowlist itself, not derived from user input — safe for logging and downstream use without taint.

public string? TryResolve(string? stateCode)

Parameters

stateCode string

Returns

string