From e6874832bf418655509f31215678fd3e2293ada6 Mon Sep 17 00:00:00 2001
From: Daniel Kristiansen <daniel.kristiansen@intility.no>
Date: Wed, 2 Sep 2026 11:05:12 +0200
Subject: [PATCH 1/2] fix(authz): add [Authorize] to sample DeleteAsync action

---
 samples/ContractApi/Controllers.cs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/samples/ContractApi/Controllers.cs b/samples/ContractApi/Controllers.cs
index 23d37a5..243f376 100644
--- a/samples/ContractApi/Controllers.cs
+++ b/samples/ContractApi/Controllers.cs
@@ -1,6 +1,7 @@
 using JsonApiToolkit.Attributes;
 using JsonApiToolkit.Controllers;
 using JsonApiToolkit.Models.Errors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -76,6 +77,7 @@ public async Task<IActionResult> UpdateAsync(int id, UpdateArticleDto dto)
     }
 
     [HttpDelete("{id:int}")]
+    [Authorize]
     public async Task<IActionResult> DeleteAsync(int id)
     {
         var article =

From 80b9c39caf079569e09e25b9a2ae929ab81f24e3 Mon Sep 17 00:00:00 2001
From: Daniel Kristiansen <daniel.kristiansen@intility.no>
Date: Wed, 2 Sep 2026 11:10:12 +0200
Subject: [PATCH 2/2] fix(authz): wire up test auth handler in sample
 Program.cs

---
 samples/ContractApi/Program.cs         |  9 +++++++++
 samples/ContractApi/TestAuthHandler.cs | 22 ++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 samples/ContractApi/TestAuthHandler.cs

diff --git a/samples/ContractApi/Program.cs b/samples/ContractApi/Program.cs
index 515e25d..ff3cbe1 100644
--- a/samples/ContractApi/Program.cs
+++ b/samples/ContractApi/Program.cs
@@ -5,6 +5,13 @@
 var builder = WebApplication.CreateBuilder(args);
 
 builder.Services.AddDbContext<ContractDbContext>(o => o.UseInMemoryDatabase("contract-api"));
+builder
+    .Services.AddAuthentication("Test")
+    .AddScheme<Microsoft.AspNetCore.Authentication.AuthenticationSchemeOptions, TestAuthHandler>(
+        "Test",
+        null
+    );
+builder.Services.AddAuthorization();
 builder.Services.AddControllers();
 builder.Services.AddJsonApiToolkit(o =>
 {
@@ -17,6 +24,8 @@
 });
 
 var app = builder.Build();
+app.UseAuthentication();
+app.UseAuthorization();
 app.MapControllers();
 
 using (var scope = app.Services.CreateScope())
diff --git a/samples/ContractApi/TestAuthHandler.cs b/samples/ContractApi/TestAuthHandler.cs
new file mode 100644
index 0000000..0a5be1c
--- /dev/null
+++ b/samples/ContractApi/TestAuthHandler.cs
@@ -0,0 +1,22 @@
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.Extensions.Options;
+
+namespace ContractApi;
+
+public class TestAuthHandler(
+    IOptionsMonitor<AuthenticationSchemeOptions> options,
+    ILoggerFactory logger,
+    UrlEncoder encoder
+) : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
+{
+    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        var claims = new[] { new Claim(ClaimTypes.Name, "test-user") };
+        var identity = new ClaimsIdentity(claims, "Test");
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, "Test");
+        return Task.FromResult(AuthenticateResult.Success(ticket));
+    }
+}