Fix for #1849

Author: mathewc

src/WebJobs.Script/Extensions/HttpRequestMessageExtensions.cs

@@ -60,19 +60,21 @@ public static bool IsAuthDisabled(this HttpRequestMessage request)
         /// the specified level.
         /// </summary>
         /// <param name="request">The request.</param>
-        /// <param name="level">The level to check.</param>
+        /// <param name="levelToCheck">The level to check.</param>
         /// <param name="keyName">Optional key name if key based auth is being used</param>
         /// <returns>True if the request is authorized at the specified level,
         /// false otherwise.</returns>
-        public static bool HasAuthorizationLevel(this HttpRequestMessage request, AuthorizationLevel level, string keyName = null)
+        public static bool HasAuthorizationLevel(this HttpRequestMessage request, AuthorizationLevel levelToCheck, string keyName = null)
         {
-            if (request.IsAuthDisabled())
+            if (request.IsAuthDisabled() || levelToCheck == AuthorizationLevel.Anonymous)
             {
+                // when auth is disabled or the required level is Anonymous
+                // the request is authorized
                 return true;
             }
 
-            var authorizationLevel = request.GetAuthorizationLevel();
-            if (authorizationLevel == AuthorizationLevel.Admin)
+            var requestAuthorizationLevel = request.GetAuthorizationLevel();
+            if (requestAuthorizationLevel == AuthorizationLevel.Admin)
             {
                 // requests authorized at admin level are always allowed
                 return true;
@@ -89,7 +91,7 @@ public static bool HasAuthorizationLevel(this HttpRequestMessage request, Author
             }
 
             // otherwise, the request level must exactly match the required level
-            return authorizationLevel == level;
+            return requestAuthorizationLevel == levelToCheck;
         }
 
         public static string GetHeaderValueOrDefault(this HttpRequestMessage request, string headerName)

test/WebJobs.Script.Tests/Extensions/HttpRequestMessageExtensions.cs

@@ -133,19 +133,23 @@ public void HasAuthorizationLevel_ReturnsExpectedValue()
         {
             var request = new HttpRequestMessage();
             Assert.True(request.HasAuthorizationLevel(AuthorizationLevel.Anonymous));
-
             Assert.False(request.HasAuthorizationLevel(AuthorizationLevel.Function));
+            Assert.False(request.HasAuthorizationLevel(AuthorizationLevel.Admin));
+
             request.SetProperty(ScriptConstants.AzureFunctionsHttpRequestAuthorizationLevelKey, AuthorizationLevel.Anonymous);
+            Assert.True(request.HasAuthorizationLevel(AuthorizationLevel.Anonymous));
             Assert.False(request.HasAuthorizationLevel(AuthorizationLevel.Function));
+            Assert.False(request.HasAuthorizationLevel(AuthorizationLevel.Admin));
+
             request.SetProperty(ScriptConstants.AzureFunctionsHttpRequestAuthorizationLevelKey, AuthorizationLevel.Function);
+            Assert.True(request.HasAuthorizationLevel(AuthorizationLevel.Anonymous));
             Assert.True(request.HasAuthorizationLevel(AuthorizationLevel.Function));
-            Assert.False(request.HasAuthorizationLevel(AuthorizationLevel.Anonymous));
-
             Assert.False(request.HasAuthorizationLevel(AuthorizationLevel.Admin));
+
             request.SetProperty(ScriptConstants.AzureFunctionsHttpRequestAuthorizationLevelKey, AuthorizationLevel.Admin);
-            Assert.True(request.HasAuthorizationLevel(AuthorizationLevel.Admin));
-            Assert.True(request.HasAuthorizationLevel(AuthorizationLevel.Function));
             Assert.True(request.HasAuthorizationLevel(AuthorizationLevel.Anonymous));
+            Assert.True(request.HasAuthorizationLevel(AuthorizationLevel.Function));
+            Assert.True(request.HasAuthorizationLevel(AuthorizationLevel.Admin));
 
             request.SetProperty(ScriptConstants.AzureFunctionsHttpRequestAuthorizationLevelKey, AuthorizationLevel.Anonymous);
             Assert.False(request.HasAuthorizationLevel(AuthorizationLevel.Admin));