[SignalR]: AuthorizeHelper should no-op if endpoint routing has already executed auth

[pranavkm]

Similar to the solution in #8387, we need to avoid re-running auth in SignalR if the middleware previously ran.

[pranavkm]

cc @rynowak \ @davidfowl \ @BrennanConroy

[analogrelay]

The work items here are:

• Scoop up all attributes on the Hub and put them in the metadata (bonus: we get CorsAttribute for free!).
• Remove our custom connection-level auth and use endpoint auth now (if endpoint routing is in play).

[davidfowl]

We already did most of this work. The last piece is to skip if it already ran

[analogrelay]

• Scoop up all attributes on the Hub

We did this? @BrennanConroy wasn't so sure...

[davidfowl]

https://github.com/aspnet/AspNetCore/blob/3e056db750d562826473f476e4f9b02ad76ffdd3/src/SignalR/server/SignalR/src/HubEndpointRouteBuilderExtensions.cs#L49

[rynowak]

I would be really careful about making things skip and be smart - rather than making sure that the app is configured correctly. The change in #8387 broke stuff in MVC because the user would configure the AuthorizeFilter manually and it would now no-op.

We landed on making it an error to have [Authorize] and not have the authorize middleware when using endpoint routing. Consider whether you can configre this behaviour based on whether or not endpoint routing is in use.

[pranavkm]

@rynowak the way I thought of doing this was to not add auth metadata to HttpConnectionDispatcherOptions as part of the extension method @davidfowl pointed. It would be analogous to how MVC would not set up a filter if you're doing endpoint routing.

[rynowak]

OK DOpe