Skip to content

Commit d3bb3b4

Browse files
tobias-tenglertobias-tengler
committed
Add ErrorOnAspNetCoreAuthorizationAttributes option
1 parent b271436 commit d3bb3b4

File tree

7 files changed

+236
-4
lines changed

7 files changed

+236
-4
lines changed

‎src/HotChocolate/Core/src/Abstractions/ErrorCodes.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,12 @@ public static class Schema
251251
/// The specified directive argument does not exist.
252252
/// </summary>
253253
public const string UnknownDirectiveArgument = "HC0072";
254+
255+
/// <summary>
256+
/// An underlying schema runtime member is annotated with an ASP.NET Core
257+
/// Authorization attribute that is not supported by Hot Chocolate.
258+
/// </summary>
259+
public const string UnsupportedAspNetCoreAttribute = "HC0081";
254260
}
255261

256262
public static class Scalars

‎src/HotChocolate/Core/src/Authorization/AuthorizationTypeInterceptor.cs‎

Lines changed: 108 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
using System.Reflection;
12
using System.Runtime.CompilerServices;
23
using System.Runtime.InteropServices;
34
using HotChocolate.Configuration;
@@ -10,11 +11,19 @@
1011
using HotChocolate.Utilities;
1112
using static HotChocolate.Authorization.AuthorizeDirectiveType.Names;
1213
using static HotChocolate.WellKnownContextData;
14+
using static HotChocolate.Authorization.Properties.AuthCoreResources;
1315

1416
namespace HotChocolate.Authorization;
1517

1618
internal sealed partial class AuthorizationTypeInterceptor : TypeInterceptor
1719
{
20+
private const string AspNetCoreAuthorizeAttributeName = "Microsoft.AspNetCore.Authorization.AuthorizeAttribute";
21+
private const string AspNetCoreAllowAnonymousAttributeName =
22+
"Microsoft.AspNetCore.Authorization.AllowAnonymousAttribute";
23+
24+
private static readonly string _authorizeAttributeName = typeof(AuthorizeAttribute).FullName!;
25+
private static readonly string _allowAnonymousAttributeName = typeof(AllowAnonymousAttribute).FullName!;
26+
1827
private readonly List<ObjectTypeInfo> _objectTypes = [];
1928
private readonly List<UnionTypeInfo> _unionTypes = [];
2029
private readonly Dictionary<ObjectType, IDirectiveCollection> _directives = new();
@@ -114,14 +123,79 @@ public override void OnBeforeCompleteType(
114123
ITypeCompletionContext completionContext,
115124
DefinitionBase definition)
116125
{
126+
if (definition is not ObjectTypeDefinition typeDef)
127+
{
128+
return;
129+
}
130+
117131
// last in the initialization we need to intercept the query type and ensure that
118132
// authorization configuration is applied to the special introspection and node fields.
119-
if (ReferenceEquals(_queryContext, completionContext) &&
120-
definition is ObjectTypeDefinition typeDef)
133+
if (ReferenceEquals(_queryContext, completionContext))
121134
{
122135
var state = _state ?? throw ThrowHelper.StateNotInitialized();
123136
HandleSpecialQueryFields(new ObjectTypeInfo(completionContext, typeDef), state);
124137
}
138+
139+
if (_context.Options.ErrorOnAspNetCoreAuthorizationAttributes && !completionContext.IsIntrospectionType)
140+
{
141+
var runtimeType = typeDef.RuntimeType;
142+
var attributesOnType = runtimeType.GetCustomAttributes().ToArray();
143+
144+
if (ContainsNamedAttribute(attributesOnType, AspNetCoreAuthorizeAttributeName))
145+
{
146+
completionContext.ReportError(
147+
UnsupportedAspNetCoreAttributeError(
148+
AspNetCoreAuthorizeAttributeName,
149+
_authorizeAttributeName,
150+
runtimeType));
151+
return;
152+
}
153+
154+
if (ContainsNamedAttribute(attributesOnType, AspNetCoreAllowAnonymousAttributeName))
155+
{
156+
completionContext.ReportError(
157+
UnsupportedAspNetCoreAttributeError(
158+
AspNetCoreAllowAnonymousAttributeName,
159+
_allowAnonymousAttributeName,
160+
runtimeType));
161+
return;
162+
}
163+
164+
foreach (var field in typeDef.Fields)
165+
{
166+
if (field.IsIntrospectionField)
167+
{
168+
continue;
169+
}
170+
171+
var fieldMember = field.ResolverMember ?? field.Member;
172+
173+
if (fieldMember is not null)
174+
{
175+
var attributesOnResolver = fieldMember.GetCustomAttributes().ToArray();
176+
177+
if (ContainsNamedAttribute(attributesOnResolver, AspNetCoreAuthorizeAttributeName))
178+
{
179+
completionContext.ReportError(
180+
UnsupportedAspNetCoreAttributeError(
181+
AspNetCoreAuthorizeAttributeName,
182+
_authorizeAttributeName,
183+
fieldMember));
184+
return;
185+
}
186+
187+
if (ContainsNamedAttribute(attributesOnResolver, AspNetCoreAllowAnonymousAttributeName))
188+
{
189+
completionContext.ReportError(
190+
UnsupportedAspNetCoreAttributeError(
191+
AspNetCoreAllowAnonymousAttributeName,
192+
_allowAnonymousAttributeName,
193+
fieldMember));
194+
return;
195+
}
196+
}
197+
}
198+
}
125199
}
126200

127201
public override void OnAfterCompleteTypes()
@@ -179,7 +253,7 @@ private void InspectObjectTypesForAuthDirective(State state)
179253

180254
// if the field contains the AnonymousAllowed flag we will not
181255
// apply authorization on it.
182-
if(fieldDef.GetContextData().ContainsKey(AllowAnonymous))
256+
if (fieldDef.GetContextData().ContainsKey(AllowAnonymous))
183257
{
184258
continue;
185259
}
@@ -353,7 +427,7 @@ private void ApplyAuthMiddleware(
353427
{
354428
// if the field contains the AnonymousAllowed flag we will not apply authorization
355429
// on it.
356-
if(fieldDef.GetContextData().ContainsKey(AllowAnonymous))
430+
if (fieldDef.GetContextData().ContainsKey(AllowAnonymous))
357431
{
358432
return;
359433
}
@@ -621,6 +695,36 @@ private State CreateState()
621695

622696
return new State(options ?? new());
623697
}
698+
699+
private static bool ContainsNamedAttribute(Attribute[] attributes, string nameOfAttribute)
700+
=> attributes.Any(a => a.GetType().FullName == nameOfAttribute);
701+
702+
private static ISchemaError UnsupportedAspNetCoreAttributeError(
703+
string aspNetCoreAttributeName,
704+
string properAttributeName,
705+
Type runtimeType)
706+
{
707+
return SchemaErrorBuilder.New()
708+
.SetMessage(string.Format(AuthorizationTypeInterceptor_UnsupportedAspNetCoreAttributeOnType,
709+
aspNetCoreAttributeName, runtimeType.FullName, properAttributeName))
710+
.SetCode(ErrorCodes.Schema.UnsupportedAspNetCoreAttribute)
711+
.Build();
712+
}
713+
714+
private static ISchemaError UnsupportedAspNetCoreAttributeError(
715+
string aspNetCoreAttributeName,
716+
string properAttributeName,
717+
MemberInfo member)
718+
{
719+
var nameOfDeclaringType = member.DeclaringType?.FullName;
720+
var nameOfMember = member.Name;
721+
722+
return SchemaErrorBuilder.New()
723+
.SetMessage(string.Format(AuthorizationTypeInterceptor_UnsupportedAspNetCoreAttributeOnMember,
724+
aspNetCoreAttributeName, nameOfDeclaringType, nameOfMember, properAttributeName))
725+
.SetCode(ErrorCodes.Schema.UnsupportedAspNetCoreAttribute)
726+
.Build();
727+
}
624728
}
625729

626730
static file class AuthorizationTypeInterceptorExtensions

‎src/HotChocolate/Core/src/Authorization/Properties/AuthCoreResources.Designer.cs‎

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/HotChocolate/Core/src/Authorization/Properties/AuthCoreResources.resx‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,4 +39,10 @@
3939
<data name="ThrowHelper_UnableToResolveTypeReg" xml:space="preserve">
4040
<value>Unable to resolve a type registration.</value>
4141
</data>
42+
<data name="AuthorizationTypeInterceptor_UnsupportedAspNetCoreAttributeOnType" xml:space="preserve">
43+
<value>Found unsupported `{0}` on `{1}`. Use `{2}` instead.</value>
44+
</data>
45+
<data name="AuthorizationTypeInterceptor_UnsupportedAspNetCoreAttributeOnMember" xml:space="preserve">
46+
<value>Found unsupported `{0}` on `{1}.{2}`. Use `{3}` instead.</value>
47+
</data>
4248
</root>

‎src/HotChocolate/Core/src/Types/IReadOnlySchemaOptions.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,12 @@ public interface IReadOnlySchemaOptions
180180
/// </summary>
181181
bool EnableTag { get; }
182182

183+
/// <summary>
184+
/// Errors if either an ASP.NET Core [Authorize] or [AllowAnonymous] attribute
185+
/// is used on a Hot Chocolate resolver or type definition.
186+
/// </summary>
187+
bool ErrorOnAspNetCoreAuthorizationAttributes { get; }
188+
183189
/// <summary>
184190
/// Specifies the default dependency injection scope for query fields.
185191
/// </summary>

‎src/HotChocolate/Core/src/Types/SchemaOptions.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,8 @@ public FieldBindingFlags DefaultFieldBindingFlags
210210
/// </summary>
211211
public bool EnableTag { get; set; } = true;
212212

213+
public bool ErrorOnAspNetCoreAuthorizationAttributes { get; set; } = true;
214+
213215
/// <summary>
214216
/// Defines the default dependency injection scope for query fields.
215217
/// </summary>

‎src/HotChocolate/Core/test/Authorization.Tests/AnnotationBasedAuthorizationTests.cs‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,78 @@ namespace HotChocolate.Authorization;
1313

1414
public class AnnotationBasedAuthorizationTests
1515
{
16+
[Fact]
17+
public async Task Microsoft_AuthorizeAttribute_On_Method_Produces_Error()
18+
{
19+
var builder = new ServiceCollection()
20+
.AddGraphQL()
21+
.AddQueryType<QueryWithMicrosoftAuthorizeAttributeOnMethod>()
22+
.AddAuthorizationCore();
23+
24+
var act = async () => await builder.BuildSchemaAsync();
25+
26+
var exception = await Assert.ThrowsAsync<SchemaException>(act);
27+
var error = exception.Errors.First();
28+
Assert.Equal(ErrorCodes.Schema.UnsupportedAspNetCoreAttribute, error.Code);
29+
Assert.Equal(
30+
"Found unsupported `Microsoft.AspNetCore.Authorization.AuthorizeAttribute` on `HotChocolate.Authorization.AnnotationBasedAuthorizationTests+QueryWithMicrosoftAuthorizeAttributeOnMethod.Field`. Use `HotChocolate.Authorization.AuthorizeAttribute` instead.",
31+
error.Message);
32+
}
33+
34+
[Fact]
35+
public async Task Microsoft_AllowAnonymousAttribute_On_Method_Produces_Error()
36+
{
37+
var builder = new ServiceCollection()
38+
.AddGraphQL()
39+
.AddQueryType<QueryWithMicrosoftAllowAnonymousAttributeOnMethod>()
40+
.AddAuthorizationCore();
41+
42+
var act = async () => await builder.BuildSchemaAsync();
43+
44+
var exception = await Assert.ThrowsAsync<SchemaException>(act);
45+
var error = exception.Errors.First();
46+
Assert.Equal(ErrorCodes.Schema.UnsupportedAspNetCoreAttribute, error.Code);
47+
Assert.Equal(
48+
"Found unsupported `Microsoft.AspNetCore.Authorization.AllowAnonymousAttribute` on `HotChocolate.Authorization.AnnotationBasedAuthorizationTests+QueryWithMicrosoftAllowAnonymousAttributeOnMethod.Field`. Use `HotChocolate.Authorization.AllowAnonymousAttribute` instead.",
49+
error.Message);
50+
}
51+
52+
[Fact]
53+
public async Task Microsoft_AuthorizeAttribute_On_Type_Produces_Error()
54+
{
55+
var builder = new ServiceCollection()
56+
.AddGraphQL()
57+
.AddQueryType<QueryWithMicrosoftAuthorizeAttribute>()
58+
.AddAuthorizationCore();
59+
60+
var act = async () => await builder.BuildSchemaAsync();
61+
62+
var exception = await Assert.ThrowsAsync<SchemaException>(act);
63+
var error = exception.Errors.First();
64+
Assert.Equal(ErrorCodes.Schema.UnsupportedAspNetCoreAttribute, error.Code);
65+
Assert.Equal(
66+
"Found unsupported `Microsoft.AspNetCore.Authorization.AuthorizeAttribute` on `HotChocolate.Authorization.AnnotationBasedAuthorizationTests+QueryWithMicrosoftAuthorizeAttribute`. Use `HotChocolate.Authorization.AuthorizeAttribute` instead.",
67+
error.Message);
68+
}
69+
70+
[Fact]
71+
public async Task Microsoft_AllowAnonymousAttribute_On_Type_Produces_Error()
72+
{
73+
var builder = new ServiceCollection()
74+
.AddGraphQL()
75+
.AddQueryType<QueryWithMicrosoftAllowAnonymousAttribute>()
76+
.AddAuthorizationCore();
77+
78+
var act = async () => await builder.BuildSchemaAsync();
79+
80+
var exception = await Assert.ThrowsAsync<SchemaException>(act);
81+
var error = exception.Errors.First();
82+
Assert.Equal(ErrorCodes.Schema.UnsupportedAspNetCoreAttribute, error.Code);
83+
Assert.Equal(
84+
"Found unsupported `Microsoft.AspNetCore.Authorization.AllowAnonymousAttribute` on `HotChocolate.Authorization.AnnotationBasedAuthorizationTests+QueryWithMicrosoftAllowAnonymousAttribute`. Use `HotChocolate.Authorization.AllowAnonymousAttribute` instead.",
85+
error.Message);
86+
}
87+
1688
[Fact]
1789
public async Task Authorize_Person_NoAccess()
1890
{
@@ -1138,4 +1210,28 @@ public ValueTask<AuthorizeResult> AuthorizeAsync(
11381210
CancellationToken cancellationToken = default)
11391211
=> new(AuthorizeResult.NotAllowed);
11401212
}
1213+
1214+
public class QueryWithMicrosoftAuthorizeAttributeOnMethod
1215+
{
1216+
[Microsoft.AspNetCore.Authorization.Authorize]
1217+
public string Field() => "foo";
1218+
}
1219+
1220+
public class QueryWithMicrosoftAllowAnonymousAttributeOnMethod
1221+
{
1222+
[Microsoft.AspNetCore.Authorization.AllowAnonymous]
1223+
public string Field() => "foo";
1224+
}
1225+
1226+
[Microsoft.AspNetCore.Authorization.Authorize]
1227+
public class QueryWithMicrosoftAuthorizeAttribute
1228+
{
1229+
public string Field() => "foo";
1230+
}
1231+
1232+
[Microsoft.AspNetCore.Authorization.AllowAnonymous]
1233+
public class QueryWithMicrosoftAllowAnonymousAttribute
1234+
{
1235+
public string Field() => "foo";
1236+
}
11411237
}

0 commit comments

Comments
 (0)