Auth engine rework

README.md

@@ -18,6 +18,9 @@
 ![Size](https://img.shields.io/github/repo-size/graphql-dotnet/authorization)
 
 A toolset for authorizing access to graph types for [GraphQL.NET](https://github.com/graphql-dotnet/graphql-dotnet).
+It provides a [validation rule](src/GraphQL.Authorization/AuthorizationValidationRule.cs) that checks all of the
+Graph Types in the given GraphQL operation (query/mutation/subscription) to see if they have authorization policies
+applied to them and evaluates these policies if any.
 
 Provides the following packages:
 
@@ -28,24 +31,44 @@ Provides the following packages:
 You can get all preview versions from [GitHub Packages](https://github.com/orgs/graphql-dotnet/packages?repo_name=authorization).
 Note that GitHub requires authentication to consume the feed. See [here](https://docs.github.com/en/free-pro-team@latest/packages/publishing-and-managing-packages/about-github-packages#authenticating-to-github-packages).
 
-# Usage
-
-* Register the authorization classes in your DI container - `IAuthorizationEvaluator`, `AuthorizationSettings`, and the `AuthorizationValidationRule`.
-* Provide a custom `UserContext` class that implements `IProvideClaimsPrincipal`.
-* Add policies to the `AuthorizationSettings`.
-* Apply a policy to a GraphType or Field (both implement `IProvideMetadata`):
-  - using `AuthorizeWith(string policy)` extension method
-  - or with `GraphQLAuthorize` attribute if using Schema + Handler syntax.
-* The `AuthorizationValidationRule` will run and verify the policies based on the registered policies.
-* You can write your own `IAuthorizationRequirement`.
-
-# Examples
+## Note for ASP.NET Core users
+
+If you came here in search for GraphQL authorization for the ASP.NET Core applications,
+then it makes sense to look into the [server](https://github.com/graphql-dotnet/server) project
+and its [GraphQL.Server.Authorization.AspNetCore](https://www.nuget.org/packages/GraphQL.Server.Authorization.AspNetCore)
+package. Although you will be able to integrate GraphQL authorization with the help of classes
+from the current repository, the _GraphQL.Server.Authorization.AspNetCore_ package is much better
+adapted to work within the ASP.NET Core applications.
+
+## Usage
+
+1. Register the necessary authorization classes in your DI container:
+   - `IValidationRule/AuthorizationValidationRule`
+   - `IAuthorizationService/DefaultAuthorizationService`
+   - `IClaimsPrincipalAccessor/DefaultClaimsPrincipalAccessor`
+   - `IAuthorizationPolicyProvider/DefaultAuthorizationPolicyProvider`
+2. If you use `DefaultClaimsPrincipalAccessor` then provide a custom `UserContext`
+class that implements `IProvideClaimsPrincipal`.
+3. Add policies to the `AuthorizationSettings`.
+4. Apply a policy to a `GraphType` or `FieldType` (both implement `IProvideMetadata`):
+   - using `AuthorizeWith(string policy)` extension method
+   - or with `GraphQLAuthorize` attribute if using Schema + Handler syntax.
+5. The `AuthorizationValidationRule` will run and verify the policies based on the
+registered policies.
+6. You can write your own `IAuthorizationRequirement` and an extension method to add
+this requirement to `AuthorizationPolicyBuilder`.
+
+## Examples
+
+#### Examples in this repository
 
 1. Fully functional basic [Console sample](src/BasicSample/Program.cs).
 
 2. Fully functional [ASP.NET Core sample](src/Harness/Program.cs).
 
-3. GraphType first syntax - use `AuthorizeWith` extension method on `IGraphType` or `IFieldType`.
+#### Add authorization policy [GraphType first syntax]
+
+Use `AuthorizeWith` extension method on `IGraphType` or `IFieldType`.
 
 ```csharp
 public class MyType : ObjectGraphType
@@ -58,7 +81,9 @@ public class MyType : ObjectGraphType
 }
 ```
 
-4. Schema first syntax - use `GraphQLAuthorize` attribute on type, method or property.
+#### Add authorization policy [Schema first syntax]
+
+Use `GraphQLAuthorize` attribute on type, method or property.
 
 ```csharp
 [GraphQLAuthorize(Policy = "MyPolicy")]
@@ -75,6 +100,126 @@ public class MutationType
 }
 ```
 
-# Known Issues
+#### Custom authorization requirement
+
+You can add your own requirements to the authorization framework to extend it.
+Create your own `IAuthorizationRequirement` class and add that requirement to your policy.
+
+```csharp
+public class OnlyMondayRequirement : IAuthorizationRequirement
+{
+    public Task Authorize(IAuthorizationContext context)
+    {
+        if (DateTime.Now.DayOfWeek == DayOfWeek.Monday)
+            context.Succeed(this);
+    }
+}
+
+public static class MyAuthorizationPolicyBuilderExtensions
+{
+    public static AuthorizationPolicyBuilder RequireMonday(this AuthorizationPolicyBuilder builder)
+    {
+        builder.AddRequirement(new OnlyMondayRequirement());
+        return builder;
+    }
+}
+
+public static void ConfigureAuthorizationServices(ServiceCollection services)
+{
+    services
+        .AddSingleton<IValidationRule, AuthorizationValidationRule>()
+        .AddSingleton<IAuthorizationService, DefaultAuthorizationService>()
+        .AddSingleton<IClaimsPrincipalAccessor, DefaultClaimsPrincipalAccessor>()
+        .AddSingleton<IAuthorizationPolicyProvider>(provider =>
+        {
+            var authSettings = new AuthorizationSettings();
+            authSettings.AddPolicy("MyPolicy", b => b.RequireMonday());
+            return new DefaultAuthorizationPolicyProvider(authSettings);
+        })
+}
+```
+
+#### How to change error messages
+
+All authorization requirements (built-in or custom ones) only check the compliance of
+the current execution state to their criteria. If the requirement is satisfied, then
+it is marked as 'passed' and the next requirement is checked. If all requirements are
+satisfied, then the validation rule returns a successful result. Otherwise for each
+unsatisfied requirement, the validation rule will add an authorization error in the
+`ValidationContext`. The text of this error may not suit you, especially if you write
+your own authorization requirements. In this case, you can override the default behavior.
+
+**Option 1.** Create a descendant from `AuthorizationValidationRule` and override
+`AddValidationError` method.
+
+```csharp
+public class CustomAuthorizationValidationRule : AuthorizationValidationRule
+{
+    public CustomAuthorizationValidationRule(IAuthorizationService authorizationService, IClaimsPrincipalAccessor claimsPrincipalAccessor, IAuthorizationPolicyProvider policyProvider)
+        : base(authorizationService, claimsPrincipalAccessor, policyProvider)
+    {
+    }
+
+    protected override void AddValidationError(INode node, ValidationContext context, OperationType? operationType, AuthorizationResult result)
+    {
+        if (result.Failure.FailedRequirements.Any(r => r is MySpecialRequirement))
+            context.ReportError(new AuthorizationError(node, context, "My special error message", result));
+        else
+            base.AddValidationError(node, context, operationType, result);
+    }
+}
+```
+
+Then register `CustomAuthorizationValidationRule` instead of `AuthorizationValidationRule`
+in your DI container.
+
+**Option 2.** Implement `IErrorInfoProvider` interface. This is one of the interfaces from
+the main GraphQL.NET repository. For convenience you may use `ErrorInfoProvider` base class. 
+
+```csharp
+public class CustomErrorInfoProvider : ErrorInfoProvider
+{
+    public override ErrorInfo GetInfo(ExecutionError executionError)
+    {
+        var info = base.GetInfo(executionError);
+        info.Message = executionError switch
+        {
+            AuthorizationError authorizationError => GetAuthorizationErrorMessage(authorizationError),
+            _ => info.Message,
+        };
+        return info;
+    }
+
+    private string GetAuthorizationErrorMessage(AuthorizationError error)
+    {
+        var errorMessage = new StringBuilder();
+        AuthorizationError.AppendFailureHeader(errorMessage, error.OperationType);
+
+        foreach (var failedRequirement in error.AuthorizationResult.Failure.FailedRequirements)
+        {
+            switch (failedRequirement)
+            {
+                case OnlyMondayRequirement onlyMondayRequirement:
+                    errorMessage.AppendLine();
+                    errorMessage.Append("Access is allowed only on Mondays.");
+                    break;
+                default:
+                    AuthorizationError.AppendFailureLine(errorMessage, failedRequirement);
+                    break;
+            }
+        }
+
+        return errorMessage.ToString();
+    }
+}
+```
+
+Then register `CustomErrorInfoProvider` in your DI container.
+
+```csharp
+services.AddSingleton<IErrorInfoProvider, CustomErrorInfoProvider>();
+```
+
+## Known Issues
 
 * It is currently not possible to add a policy to Input objects using Schema first approach.

src/BasicSample/Program.cs

@@ -18,13 +18,14 @@ internal class Program
         private static async Task Main()
         {
             using var serviceProvider = new ServiceCollection()
-                .AddSingleton<IAuthorizationEvaluator, AuthorizationEvaluator>()
-                .AddTransient<IValidationRule, AuthorizationValidationRule>()
-                .AddTransient(s =>
+                .AddSingleton<IValidationRule, AuthorizationValidationRule>()
+                .AddSingleton<IAuthorizationService, DefaultAuthorizationService>()
+                .AddSingleton<IClaimsPrincipalAccessor, DefaultClaimsPrincipalAccessor>()
+                .AddSingleton<IAuthorizationPolicyProvider>(provider =>
                 {
                     var authSettings = new AuthorizationSettings();
-                    authSettings.AddPolicy("AdminPolicy", p => p.RequireClaim("role", "Admin"));
-                    return authSettings;
+                    authSettings.AddPolicy("AdminPolicy", b => b.RequireClaim("role", "Admin"));
+                    return new DefaultAuthorizationPolicyProvider(authSettings);
                 })
                 .BuildServiceProvider();
 
@@ -41,20 +42,24 @@ type Query {
             ";
             var schema = Schema.For(definitions, builder => builder.Types.Include<Query>());
 
-            // remove claims to see the failure
             var authorizedUser = new ClaimsPrincipal(new ClaimsIdentity(new[] { new Claim("role", "Admin") }));
+            var nonAuthorizedUser = new ClaimsPrincipal(new ClaimsIdentity());
 
-            string json = await schema.ExecuteAsync(_ =>
+            foreach (var principal in new[] { authorizedUser, nonAuthorizedUser })
             {
-                _.Query = "{ viewer { id name } }";
-                _.ValidationRules = serviceProvider
-                    .GetServices<IValidationRule>()
-                    .Concat(DocumentValidator.CoreRules);
-                _.RequestServices = serviceProvider;
-                _.UserContext = new GraphQLUserContext { User = authorizedUser };
-            });
+                string json = await schema.ExecuteAsync(options =>
+                {
+                    options.Query = "{ viewer { id name } }";
+                    options.ValidationRules = serviceProvider
+                        .GetServices<IValidationRule>()
+                        .Concat(DocumentValidator.CoreRules);
+                    options.RequestServices = serviceProvider;
+                    options.UserContext = new GraphQLUserContext { User = principal };
+                });
 
-            Console.WriteLine(json);
+                Console.WriteLine(json);
+                Console.WriteLine();
+            }
         }
     }
 
@@ -64,7 +69,7 @@ type Query {
     public class GraphQLUserContext : Dictionary<string, object>, IProvideClaimsPrincipal
     {
         /// <inheritdoc />
-        public ClaimsPrincipal User { get; set; }
+        public ClaimsPrincipal? User { get; set; }
     }
 
     /// <summary>
@@ -92,11 +97,11 @@ public class User
         /// <summary>
         /// Resolver for 'User.id' field. Just a simple property.
         /// </summary>
-        public string Id { get; set; }
+        public string? Id { get; set; }
 
         /// <summary>
         /// Resolver for 'User.name' field. Just a simple property.
         /// </summary>
-        public string Name { get; set; }
+        public string? Name { get; set; }
     }
 }

src/Directory.Build.props

@@ -16,6 +16,7 @@
     <DebugType>embedded</DebugType>
     <EmbedUntrackedSources>true</EmbedUntrackedSources>
     <EnableNETAnalyzers>true</EnableNETAnalyzers>
+    <Nullable>enable</Nullable>
   </PropertyGroup>
 
   <ItemGroup>