What we are trying to achieve
Our platform is consumed through several channels simultaneously — multiple web applications, mobile applications, and direct API integrations used by partner systems. All of them authenticate against the same auth server and share the same users, roles, and permission definitions.
We need permission granting to keep working exactly as it does today through user and role providers. On top of that, we need a purely subtractive rule: for a user who already holds a permission, that permission may be blocked on certain channels while remaining available on others. A user who does not hold the permission stays blocked everywhere — the channel dimension should never grant anything by itself.
The mapping differs per user. It is not a property of the permission, nor of the channel, but of the combination of user, permission, and channel.
Example
With two channels (Mobile, Api), two users (u1, u2), and two operations (op1, op2), all four permissions granted through roles:
| User | Operation | Mobile | Api | |---|---|---|---| | u1 | op1 | allowed | blocked | | u1 | op2 | blocked | allowed | | u2 | op1 | blocked | allowed | | u2 | op2 | allowed | allowed |
Our questions
Does ABP already provide a built-in way to express this that we may have missed? We looked at ClientPermissionValueProvider, but it appears to grant permissions to a client rather than constrain permissions a user already holds, and it has no per-user dimension.
If there is no built-in support, what is the recommended extension point for this? We would like to follow the approach the ABP team considers correct rather than pick one and discover later that it breaks on upgrade or bypasses part of the pipeline.
Is there a supported way to represent an explicit denial in permission storage? PermissionGrant is keyed on provider name, provider key, and permission name, and we could not find a representation for "granted but blocked in this context."
How should the client side be handled? AbpApplicationConfigurationAppService returns a single permission set per user, so a mobile app and an API caller receive an identical set. Is there a recommended way to make this endpoint channel-aware so the UI does not render actions that will fail at invocation time?
Is this scenario considered in scope for the framework, or is it expected to live entirely in application code? A clear answer here is enough for us to commit to a direction.
Environment
8.3Angular + Mvc + Flutter for mobileYesAngular app first time login is work fine, but when refresh the page there is an error occured due to reading AccessToken which is encrypted in line remember-me.service.ts
ERROR SyntaxError: Unexpected token 'õ', "õ¿Ø]&¶`"... is not valid JSON
at JSON.parse (<anonymous>)
Steps to reproduce
Suggestion to Solve I can see the id_token is available to read same as access_token when encryption enabled. Try read access_token when error occured read id_token if exists.
How can implement phantom token with OpenIddect? Please look below url https://curity.io/resources/learn/phantom-token-pattern/
