Start protecting the Api

src/Yavsc.Api/Program.cs

@@ -58,7 +58,7 @@ internal class Program
                 {
                     policy
                         .RequireAuthenticatedUser()
-                        .RequireClaim(JwtClaimTypes.Scope, new string[] { "scope2" });
+                        .RequireClaim(JwtClaimTypes.Scope, new string[] { "com" });
                 });
             })
             .AddCors(options =>

src/Yavsc.Blogs/Controllers/BlogApiController.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Yavsc.Models;
@@ -6,6 +7,7 @@ using Yavsc.Server.Helpers;
 
 namespace Yavsc.Controllers
 {
+    [Authorize("BlogScope")]
     [Produces("application/json")]
     [Route("api/blog")]
 

src/Yavsc.Blogs/Program.cs

@@ -41,11 +41,11 @@ internal class Program
         services
             .AddAuthorization(options =>
             {
-                options.AddPolicy("ApiScope", policy =>
+                options.AddPolicy("BlogScope", policy =>
             {
                 policy
                     .RequireAuthenticatedUser()
-                    .RequireClaim(JwtClaimTypes.Scope, new string[] { "blogs" });
+                    .RequireClaim(JwtClaimTypes.Scope, new string[] { "blog" });
             });
             })
             .AddCors(options =>

src/Yavsc.Org/Contants.cs

@@ -0,0 +1,5 @@
+
+public static class Constants
+{
+     public static readonly string[] BuildInApiScopes = {  "blog", "admin", "contract", "com" };
+}

src/Yavsc.Org/Extensions/HostingExtensions.cs

@@ -342,7 +342,7 @@ public static class HostingExtensions
     {
         return (context, _) =>
         {
-            foreach (String scope in new string[] { "blog", "admin", "contract", "com" })
+            foreach (String scope in Constants.BuildInApiScopes)
             {
                 var existentScope = context.Set<ApiScope>().FirstOrDefault(b => b.Name == scope);
                 if (existentScope == null)