Integrate AuthorizeView with actual authorization (#10487)

Author: SteveSandersonMS

src/Components/Blazor/Blazor/src/Hosting/WebAssemblyHostBuilder.cs

@@ -8,6 +8,8 @@
 using Microsoft.AspNetCore.Components;
 using Microsoft.AspNetCore.Components.Routing;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.Extensions.Logging;
 using Microsoft.JSInterop;
 
 namespace Microsoft.AspNetCore.Blazor.Hosting
@@ -92,6 +94,7 @@ private void CreateServiceProvider()
             services.AddSingleton<IComponentContext, WebAssemblyComponentContext>();
             services.AddSingleton<IUriHelper>(WebAssemblyUriHelper.Instance);
             services.AddSingleton<INavigationInterception>(WebAssemblyNavigationInterception.Instance);
+            services.AddSingleton<ILoggerFactory, WebAssemblyLoggerFactory>();
             services.AddSingleton<HttpClient>(s =>
             {
                 // Creating the URI helper needs to wait until the JS Runtime is initialized, so defer it.
@@ -102,6 +105,10 @@ private void CreateServiceProvider()
                 };
             });
 
+            // Needed for authorization
+            services.AddOptions();
+            services.TryAdd(ServiceDescriptor.Singleton(typeof(ILogger<>), typeof(WebAssemblyConsoleLogger<>)));
+
             foreach (var configureServicesAction in _configureServicesActions)
             {
                 configureServicesAction(_BrowserHostBuilderContext, services);

src/Components/Blazor/Blazor/src/Services/WebAssemblyConsoleLogger.cs

@@ -0,0 +1,34 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using Microsoft.Extensions.Logging;
+
+namespace Microsoft.AspNetCore.Blazor.Services
+{
+    internal class WebAssemblyConsoleLogger<T> : ILogger<T>, ILogger
+    {
+        public IDisposable BeginScope<TState>(TState state)
+        {
+            return NoOpDisposable.Instance;
+        }
+
+        public bool IsEnabled(LogLevel logLevel)
+        {
+            return logLevel >= LogLevel.Warning;
+        }
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception exception, Func<TState, Exception, string> formatter)
+        {
+            var formattedMessage = formatter(state, exception);
+            Console.WriteLine($"[{logLevel}] {formattedMessage}");
+        }
+
+        private class NoOpDisposable : IDisposable
+        {
+            public static NoOpDisposable Instance = new NoOpDisposable();
+
+            public void Dispose() { }
+        }
+    }
+}

src/Components/Blazor/Blazor/src/Services/WebAssemblyLoggerFactory.cs

@@ -0,0 +1,23 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using Microsoft.Extensions.Logging;
+
+namespace Microsoft.AspNetCore.Blazor.Services
+{
+    internal class WebAssemblyLoggerFactory : ILoggerFactory
+    {
+        public void AddProvider(ILoggerProvider provider)
+        {
+            // No-op
+        }
+
+        public ILogger CreateLogger(string categoryName)
+            => new WebAssemblyConsoleLogger<object>();
+
+        public void Dispose()
+        {
+            // No-op
+        }
+    }
+}

src/Components/Components/ref/Microsoft.AspNetCore.Components.csproj

@@ -5,6 +5,7 @@
   </PropertyGroup>
   <ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0'">
     <Compile Include="Microsoft.AspNetCore.Components.netstandard2.0.cs" />
+    <Reference Include="Microsoft.AspNetCore.Authorization"  />
     <Reference Include="Microsoft.JSInterop"  />
     <Reference Include="System.ComponentModel.Annotations"  />
   </ItemGroup>

src/Components/Components/ref/Microsoft.AspNetCore.Components.netstandard2.0.Manual.cs

@@ -59,7 +59,13 @@ public AuthorizeView() { }
         [Microsoft.AspNetCore.Components.ParameterAttribute]
         public Microsoft.AspNetCore.Components.RenderFragment<Microsoft.AspNetCore.Components.AuthenticationState> ChildContent { [System.Runtime.CompilerServices.CompilerGeneratedAttribute]get { throw null; } private set { throw null; } }
         [Microsoft.AspNetCore.Components.ParameterAttribute]
-        public Microsoft.AspNetCore.Components.RenderFragment NotAuthorized { [System.Runtime.CompilerServices.CompilerGeneratedAttribute]get { throw null; } private set { throw null; } }
+        public Microsoft.AspNetCore.Components.RenderFragment<Microsoft.AspNetCore.Components.AuthenticationState> NotAuthorized { [System.Runtime.CompilerServices.CompilerGeneratedAttribute]get { throw null; } private set { throw null; } }
+        [Microsoft.AspNetCore.Components.ParameterAttribute]
+        public string Policy { [System.Runtime.CompilerServices.CompilerGeneratedAttribute]get { throw null; } private set { throw null; } }
+        [Microsoft.AspNetCore.Components.ParameterAttribute]
+        public string Roles { [System.Runtime.CompilerServices.CompilerGeneratedAttribute]get { throw null; } private set { throw null; } }
+        [Microsoft.AspNetCore.Components.ParameterAttribute]
+        public object Resource { [System.Runtime.CompilerServices.CompilerGeneratedAttribute]get { throw null; } private set { throw null; } }
         protected override void BuildRenderTree(Microsoft.AspNetCore.Components.RenderTree.RenderTreeBuilder builder) { }
         [System.Diagnostics.DebuggerStepThroughAttribute]
         protected override System.Threading.Tasks.Task OnParametersSetAsync() { throw null; }

src/Components/Components/src/Auth/AuthorizeDataAdapter.cs

@@ -0,0 +1,39 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using Microsoft.AspNetCore.Authorization;
+
+namespace Microsoft.AspNetCore.Components
+{
+    // This is so the AuthorizeView can avoid implementing IAuthorizeData (even privately)
+    internal class AuthorizeDataAdapter : IAuthorizeData
+    {
+        private readonly AuthorizeView _component;
+
+        public AuthorizeDataAdapter(AuthorizeView component)
+        {
+            _component = component ?? throw new ArgumentNullException(nameof(component));
+        }
+
+        public string Policy
+        {
+            get => _component.Policy;
+            set => throw new NotSupportedException();
+        }
+
+        public string Roles
+        {
+            get => _component.Roles;
+            set => throw new NotSupportedException();
+        }
+
+        // AuthorizeView doesn't expose any such parameter, as it wouldn't be used anyway,
+        // since we already have the ClaimsPrincipal by the time AuthorizeView gets involved.
+        public string AuthenticationSchemes
+        {
+            get => null;
+            set => throw new NotSupportedException();
+        }
+    }
+}

src/Components/Components/src/Auth/AuthorizeView.razor

@@ -1,20 +1,26 @@
 @namespace Microsoft.AspNetCore.Components
+@using System.Security.Claims
+@using Microsoft.AspNetCore.Authorization
+@inject IAuthorizationService AuthorizationService
+@inject IAuthorizationPolicyProvider AuthorizationPolicyProvider
 
 @if (currentAuthenticationState == null)
 {
     @Authorizing
 }
-else if (IsAuthorized())
+else if (isAuthorized)
 {
     @((Authorized ?? ChildContent)?.Invoke(currentAuthenticationState))
 }
 else
 {
-    @NotAuthorized
+    @(NotAuthorized?.Invoke(currentAuthenticationState))
 }
 
 @functions {
+    private IAuthorizeData[] selfAsAuthorizeData;
     private AuthenticationState currentAuthenticationState;
+    private bool isAuthorized;
 
     [CascadingParameter] private Task<AuthenticationState> AuthenticationState { get; set; }
 
@@ -26,7 +32,7 @@ else
     /// <summary>
     /// The content that will be displayed if the user is not authorized.
     /// </summary>
-    [Parameter] public RenderFragment NotAuthorized { get; private set; }
+    [Parameter] public RenderFragment<AuthenticationState> NotAuthorized { get; private set; }
 
     /// <summary>
     /// The content that will be displayed if the user is authorized.
@@ -39,6 +45,29 @@ else
     /// </summary>
     [Parameter] public RenderFragment Authorizing { get; private set; }
 
+    /// <summary>
+    /// The policy name that determines whether the content can be displayed.
+    /// </summary>
+    [Parameter] public string Policy { get; private set; }
+
+    /// <summary>
+    /// A comma delimited list of roles that are allowed to display the content.
+    /// </summary>
+    [Parameter] public string Roles { get; private set; }
+
+    /// <summary>
+    /// The resource to which access is being controlled.
+    /// </summary>
+    [Parameter] public object Resource { get; private set; }
+
+    protected override void OnInit()
+    {
+        selfAsAuthorizeData = new[]
+        {
+            new AuthorizeDataAdapter((AuthorizeView)(object)this)
+        };
+    }
+
     protected override async Task OnParametersSetAsync()
     {
         // We allow 'ChildContent' for convenience in basic cases, and 'Authorized' for symmetry
@@ -54,15 +83,17 @@ else
         currentAuthenticationState = null;
 
         // Then render in completed state
+        // Importantly, we *don't* call StateHasChanged between the following async steps,
+        // otherwise we'd display an incorrect UI state while waiting for IsAuthorizedAsync
         currentAuthenticationState = await AuthenticationState;
+        isAuthorized = await IsAuthorizedAsync(currentAuthenticationState.User);
     }
 
-    private bool IsAuthorized()
+    private async Task<bool> IsAuthorizedAsync(ClaimsPrincipal user)
     {
-        // TODO: Support various authorization condition parameters, equivalent to those offered
-        // by the [Authorize] attribute, e.g., "Roles" and "Policy". This is on hold until we're
-        // able to reference the policy evaluator APIs from this package.
-
-        return currentAuthenticationState.User?.Identity?.IsAuthenticated == true;
+        var policy = await AuthorizationPolicy.CombineAsync(
+            AuthorizationPolicyProvider, selfAsAuthorizeData);
+        var result = await AuthorizationService.AuthorizeAsync(user, Resource, policy);
+        return result.Succeeded;
     }
 }

src/Components/Components/src/Microsoft.AspNetCore.Components.csproj

@@ -10,6 +10,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <Reference Include="Microsoft.AspNetCore.Authorization" />
     <Reference Include="Microsoft.JSInterop" />
     <Reference Include="System.ComponentModel.Annotations" />
   </ItemGroup>