Bump GraphQL Version, update rules

Author: joemcbride

src/GraphQL.Authorization/AuthorizationPolicyBuilder.cs

@@ -1,4 +1,5 @@
 using System.Collections.Generic;
+using System.Linq;
 
 namespace GraphQL.Authorization
 {
@@ -24,9 +25,16 @@ public AuthorizationPolicyBuilder RequireClaim(string claimType)
             return this;
         }
 
-        public AuthorizationPolicyBuilder RequireClaim(string claimType, params string[] requiredValues)
+        public AuthorizationPolicyBuilder RequireClaim(string claimType, params string[] allowedValues)
         {
-            var requirement = new ClaimAuthorizationRequirement(claimType, requiredValues);
+            var requirement = new ClaimAuthorizationRequirement(claimType, allowedValues);
+            _requirements.Add(requirement);
+            return this;
+        }
+
+        public AuthorizationPolicyBuilder RequireClaim(string claimType, IEnumerable<string> allowedValues, IEnumerable<string> displayValues)
+        {
+            var requirement = new ClaimAuthorizationRequirement(claimType, allowedValues, displayValues);
             _requirements.Add(requirement);
             return this;
         }

src/GraphQL.Authorization/AuthorizationValidationRule.cs

@@ -1,4 +1,5 @@
 using GraphQL.Language.AST;
+using GraphQL.Types;
 using GraphQL.Validation;
 
 namespace GraphQL.Authorization
@@ -18,32 +19,52 @@ public INodeVisitor Validate(ValidationContext context)
 
             return new EnterLeaveListener(_ =>
             {
-                // this could leak info about hidden fields in error messages
+                var operationType = OperationType.Query;
+
+                // this could leak info about hidden fields or types in error messages
                 // it would be better to implement a filter on the Schema so it
                 // acts as if they just don't exist vs. an auth denied error
                 // - filtering the Schema is not currently supported
+
+                _.Match<Operation>(astType =>
+                {
+                    operationType = astType.OperationType;
+
+                    var type = context.TypeInfo.GetLastType();
+                    CheckAuth(astType, type, userContext, context, operationType);
+                });
+
                 _.Match<Field>(fieldAst =>
                 {
                     var fieldDef = context.TypeInfo.GetFieldDef();
+                    CheckAuth(fieldAst, fieldDef, userContext, context, operationType);
+                });
+            });
+        }
 
-                    if (!fieldDef.RequiresAuthorization()) return;
+        private void CheckAuth(
+            INode node,
+            IProvideMetadata type,
+            IProvideClaimsPrincipal userContext,
+            ValidationContext context,
+            OperationType operationType)
+        {
+            if (type == null || !type.RequiresAuthorization()) return;
 
-                    var result = fieldDef
-                        .Authorize(userContext?.User, context.UserContext, _evaluator)
-                        .GetAwaiter()
-                        .GetResult();
+            var result = type
+                .Authorize(userContext?.User, context.UserContext, _evaluator)
+                .GetAwaiter()
+                .GetResult();
 
-                    if (result.Succeeded) return;
+            if (result.Succeeded) return;
 
-                    var errors = string.Join("\n", result.Errors);
+            var errors = string.Join("\n", result.Errors);
 
-                    context.ReportError(new ValidationError(
-                        context.OriginalQuery,
-                        "authorization",
-                        $"You are not authorized to run this query.\n{errors}",
-                        fieldAst));
-                });
-            });
+            context.ReportError(new ValidationError(
+                context.OriginalQuery,
+                "authorization",
+                $"You are not authorized to run this {operationType.ToString().ToLower()}.\n{errors}",
+                node));
         }
     }
 }

src/GraphQL.Authorization/ClaimAuthorizationRequirement.cs

@@ -8,23 +8,30 @@ namespace GraphQL.Authorization
     public class ClaimAuthorizationRequirement : IAuthorizationRequirement
     {
         private readonly string _claimType;
+        private readonly IEnumerable<string> _displayValues;
         private readonly IEnumerable<string> _allowedValues;
 
         public ClaimAuthorizationRequirement(string claimType)
-            : this(claimType, null)
+            : this(claimType, null, null)
         {
         }
 
         public ClaimAuthorizationRequirement(string claimType, IEnumerable<string> allowedValues)
+            : this(claimType, allowedValues, null)
+        {
+        }
+
+        public ClaimAuthorizationRequirement(string claimType, IEnumerable<string> allowedValues, IEnumerable<string> displayValues)
         {
             _claimType = claimType;
             _allowedValues = allowedValues ?? new List<string>();
+            _displayValues = displayValues;
         }
 
         public Task Authorize(AuthorizationContext context)
         {
             var found = false;
-            if(_allowedValues == null || !_allowedValues.Any())
+            if (_allowedValues == null || !_allowedValues.Any())
             {
                 found = context.User.Claims.Any(
                     c => string.Equals(c.Type, _claimType, StringComparison.OrdinalIgnoreCase));
@@ -40,7 +47,7 @@ public Task Authorize(AuthorizationContext context)
             {
                 if (_allowedValues != null && _allowedValues.Any())
                 {
-                    var values = string.Join(", ", _allowedValues);
+                    var values = string.Join(", ", _displayValues ?? _allowedValues);
                     context.ReportError($"Required claim '{_claimType}' with any value of '{values}' is not present.");
                 }
                 else

src/GraphQL.Authorization/GraphQL.Authorization.csproj

@@ -26,8 +26,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="GraphQL" Version="0.18.0-alpha-754" />
-    <PackageReference Include="GraphQL-Parser" Version="2.0.0" />
+    <PackageReference Include="GraphQL" Version="2.0.0-alpha-783" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'netstandard1.3'">