private async Task CheckAuthorizationAsync(Todo todo, CancellationToken cancellationToken) { var currentAccount = await accountProvider.GetCurrentAsync(cancellationToken); if (!todo.CanEdit(currentAccount)) { throw new UnauthorizedRequestException("Todo can only be renamed by its owner or editors"); } }