CriticalSubjectMembersStep Class

Enforces the receiver half of subject processing (SSF 1.0 Section 3.6): an event whose subject carries a critical member this receiver cannot interpret is discarded, never processed with the member silently dropped - acting on a subject while blind to a member the transmitter declared essential could act on the wrong principal.

public sealed class CriticalSubjectMembersStep : Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator

Inheritance System.Object → CriticalSubjectMembersStep

Implements Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator

Remarks

"Unable to process" is structural here: a complex-subject member the subject vocabulary interprets lands in a typed property, and one it cannot interpret survives only as raw JSON in Abblix.SecurityEvents.Subjects.ComplexSubject.AdditionalMembers - which is exactly the set this step checks the critical names against. A "sub_id" that does not parse at all is rejected on the same reasoning: a receiver that cannot name the subject cannot process any member of it. An absent "sub_id" passes - whether the claim is required at all belongs to the event's own rules, not to this step.

Methods

CriticalSubjectMembersStep.ValidateAsync(SecurityEventTokenValidationContext, CancellationToken) Method

Checks the token in flight.

public System.Threading.Tasks.ValueTask<Abblix.SecurityEvents.Validation.SecurityEventTokenValidationError?> ValidateAsync(Abblix.SecurityEvents.Validation.SecurityEventTokenValidationContext context, System.Threading.CancellationToken cancellationToken);