Skip to main content

API Authorization

Summary​

Authorization differs materially by route owner. HR Operations applies controller authentication plus permission, role, ownership, reporting-line, and visible-workforce checks. Monolith Recruitment uses action authentication and a broad access check. Extracted Recruitment defines no active policies and applies no endpoint authorization.

Audience​

Developers, QA, support, security reviewers, and solution architects.

Authorization matrix​

SurfaceVerified authorization
Native RecruitmentNone applied at endpoint mappings
Extracted compatibilityNone applied at endpoint mappings
Public offer responseCapability-link lookup only
Monolith compatibility onboardingAuthenticated action plus controller access check
Generic onboarding taskManagement permission across onboarding/workforce/HR Operations scopes
Exit self-serviceSpecific self permissions with employee-role fallbacks
Exit manager/admin decisionsTarget visibility plus approval/rejection permission or role logic
Access revokeSpecific revoke permission or administrator role
Employee Service direct groupNo endpoint authorization metadata found
GatewayNo authorization policy applied by proxy pipeline

Frontend protected routes and navigation permission labels are presentation controls, not API authorization evidence.

Compatibility risk​

The same portal-shaped Recruitment operation can be authenticated and access-checked on the monolith path but lack a required endpoint policy on the extracted path. Gateway selection therefore changes effective authorization behavior without changing the external route.

Missing endpoint authorization​

The Recruitment policy list is empty. Authentication and authorization middleware are present, but none of the inspected lifecycle groups calls a required-policy or authenticated-user mapping. This is a verified security gap unless a deployment perimeter makes the service unreachable to untrusted callers.

Requires confirmation​

  • Required permissions for each native and compatibility lifecycle operation.
  • Whether public offer link possession is sufficient authorization for all tenants.
  • Direct-service network reachability and perimeter enforcement.
  • Test ownership for cross-role, cross-manager, and cross-tenant denial cases.

Source References​

  • microservices/src/recruitment-service/Program.cs
  • microservices/src/recruitment-service/Api/Policies.cs
  • microservices/src/recruitment-service/Api/RecruitmentEndpoints.cs
  • microservices/src/recruitment-service/Api/RecruitmentCompatEndpoints.cs
  • Controllers/RecruitmentController.cs
  • Controllers/HrOperationsController.cs
  • UI/salary-ui/apps/client-hrms-portal/src/utils/ProtectedRoute.tsx

See Also​

Keywords​

  • Permission enforcement
  • Missing endpoint policy
  • Workforce visibility

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Review cycle: Quarterly