title: ASP.NET Core Identity Authorization using Parameter for Team Membership
body: <p>I have an application with tables like this:</p>
  
  <ul>
  <li>User (ASP.NET Core Identity)</li>
  <li>Team</li>
  <li>UserTeam (many-to-many join table)</li>
  </ul>
  
  <p>Users can be members of multiple teams, and can have different Roles within the teams. For example a User may be a TeamAdmin for TeamA but just a normal member of TeamB. Because of this, simple Role checks and Policies defined with static values won't work.</p>
  
  <p>I'm looking for a way to authorize Controller Actions for Users based on their Team and their role in the Team, which will either be added as a Claim or with a separate RoleTeam table. Assuming a Controller action like this:</p>
  
  <pre><code>[HttpGet]
  [Authorize(???)]
  public IActionResult ManageTeam(Guid teamId)
  { }
  </code></pre>
  
  <p>I would need to verify that the User has the TeamAdmin Role for the Team in question. Is there a clean way to decorate it with an Authorize attribute that can access the <code>teamId</code> parameter? Or will I have to wrap the guts of all of these Actions in <code>if (User.IsTeamAdmin(teamId)</code> ... statements?</p>