✅ C# private endpoint security: How should it be done?

public class UserIsOwnedRequirement : IAuthorizationRequirement
{
    public required string UserId { get; init; }
}

public class UserIsOwnedHandler : AuthorizationHandler<UserIsOwnedRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserIsOwnedRequirement requirement)
    {
        if (requirement.UserId != context.User?.Claims
                .FirstOrDefault(c => c.Type == ClaimTypes.NameIdentifier)?.Value)
        {
            context.Fail();
        }
        else
        {
            context.Succeed(requirement);
        }
        
        return Task.CompletedTask;
    }
}

public class UserIsOwnedRequirement : IAuthorizationRequirement
{
    public required string UserId { get; init; }
}

public class UserIsOwnedHandler : AuthorizationHandler<UserIsOwnedRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserIsOwnedRequirement requirement)
    {
        if (requirement.UserId != context.User?.Claims
                .FirstOrDefault(c => c.Type == ClaimTypes.NameIdentifier)?.Value)
        {
            context.Fail();
        }
        else
        {
            context.Succeed(requirement);
        }
        
        return Task.CompletedTask;
    }
}

[HttpGet("/user/:userId/server/:serverId")]
public async Task<IActionResult> HandleStuff(long userId, long serverId)
{
    // Validate any params here:
    
    var userOwnership = await _authorizationService.AuthorizeAsync(HttpContext.User, null, [new UserIsOwnedRequirement { UserId = userId }]);

    if (!userOwnership.Succeeded)
    {
        return Forbidden(); // or not found or whatever
    }

    var serverOwnership = await _authorizationService.AuthorizeAsync(HttpContext.User, null, [new ServerOwnershipRequirement { ServerId = serverId }]);

    if (!serverOwnership.Succeed)
    {
        return Forbidden(); // or whatever
    }

    // Success path here
}

[HttpGet("/user/:userId/server/:serverId")]
public async Task<IActionResult> HandleStuff(long userId, long serverId)
{
    // Validate any params here:
    
    var userOwnership = await _authorizationService.AuthorizeAsync(HttpContext.User, null, [new UserIsOwnedRequirement { UserId = userId }]);

    if (!userOwnership.Succeeded)
    {
        return Forbidden(); // or not found or whatever
    }

    var serverOwnership = await _authorizationService.AuthorizeAsync(HttpContext.User, null, [new ServerOwnershipRequirement { ServerId = serverId }]);

    if (!serverOwnership.Succeed)
    {
        return Forbidden(); // or whatever
    }

    // Success path here
}