#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Endpoints\.Authorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization 'Abblix\.Oidc\.Server\.Endpoints\.Authorization')

## ConsentConstraintEnforcer Class

Default [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer')\. Asserts `granted ⊆ requested` for scopes,
resources \(including their nested scopes\) and RFC 9396 `authorization_details`, throwing
when the consent provider returned anything outside the request\.

```csharp
public class ConsentConstraintEnforcer : Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ConsentConstraintEnforcer

Implements [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer')
### Constructors

## ConsentConstraintEnforcer\(IAuthorizationDetailsPolicy\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.ConsentConstraintEnforcer(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy)}

Default [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer')\. Asserts `granted ⊆ requested` for scopes,
resources \(including their nested scopes\) and RFC 9396 `authorization_details`, throwing
when the consent provider returned anything outside the request\.

```csharp
public ConsentConstraintEnforcer(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy authorizationDetailsPolicy);
```
#### Parameters

###### `authorizationDetailsPolicy` [IAuthorizationDetailsPolicy](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy') {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.ConsentConstraintEnforcer(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).authorizationDetailsPolicy}

Re\-runs granted `authorization_details` through the
            per\-type validators and per\-client allowlist; the per\-type validator owns the "is B a narrowing
            of A" decision for intra\-entry content \(RFC 9396 has no universal comparator\)\.
### Methods

## ConsentConstraintEnforcer\.EnforceAsync\(ValidAuthorizationRequest, ConsentDefinition, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken)}

Asserts that the granted consent does not exceed the request\. The granted set is left
unchanged on success\.

```csharp
public System.Threading.Tasks.Task EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Features.Consents.ConsentDefinition granted, System.Threading.CancellationToken cancellationToken);
```
#### Parameters

###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken).request}

The validated authorization request carrying the requested scopes,
            resources and `authorization_details`\.

###### `granted` [ConsentDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition 'Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition') {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken).granted}

The consent decision produced by [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider')\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken).cancellationToken}

Cancellation token\.

Implements [EnforceAsync\(ValidAuthorizationRequest, ConsentDefinition, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer#Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer\.EnforceAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition, System\.Threading\.CancellationToken\)')

#### Returns
[System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task')

#### Exceptions

[System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException')  
Thrown when the granted set contains a scope,
            resource, resource scope or `authorization_details` entry absent from — or broader than —
            the request\.