using Microsoft.AspNetCore.Authorization;

public class PermissionAuthorizationHandler : AuthorizationHandler<PermissionRequirement>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        PermissionRequirement requirement)
    {
        var roleClaim = context.User.FindFirst("clinical_role")?.Value;
        if (roleClaim is null)
            return Task.CompletedTask;

        var role = ClinicalRoleExtensions.FromDbString(roleClaim);
        if (ClinicalRolePermissionMap.HasPermission(role, requirement.Permission))
            context.Succeed(requirement);

        return Task.CompletedTask;
    }
}