Can I authorize per multiple policies ? about authorization HOT 16 OPEN

graphQLQuery.Field<ResponseGraphType<AccountType>>(
	"me",
	resolve: context =>
	{
		// code to resolve here...
	}
).RequireRole("admin", "teacher");

public static void RequireRole(this IProvideMetadata type, params string[] rolesToAdd)
{
	var roles = type.GetMetadata<List<string>>("Roles");

	if (roles == null)
	{
		roles = new List<string>();
		type.Metadata["Roles"] = roles;
	}

	roles.Add($"{string.Join(',', rolesToAdd)}");
}

public class FieldRoleValidationRule : IValidationRule
	{
		public INodeVisitor Validate(ValidationContext context)
		{
			var userContext = context.UserContext as GraphQLUserContext;
			var authenticated = userContext.User?.Identity.IsAuthenticated ?? false;

			return new EnterLeaveListener(_ =>
			{
				_.Match<Field>(fieldAst =>
				{
					var fieldDef = context.TypeInfo.GetFieldDef();
					if (fieldDef.RequiresRole() &&
						(!authenticated || !fieldDef.UserHasValidRole(userContext.User.Claims)))
					{
						context.ReportError(new ValidationError(
						  context.OriginalQuery,
						  "auth-required",
						  $"You are not authorized to run this query.",
						  fieldAst));
					}
				});
			});
		}
	}

builder.RegisterType<FieldRoleValidationRule>().As<IValidationRule>().InstancePerDependency();

public static bool UserHasValidRole(this IProvideMetadata type, IEnumerable<Claim> claims)
{
	var roles = type.GetMetadata<IEnumerable<string>>("Roles", new List<string>());
       // Code to check roles agains claims here
}

public class MyAuthorizationEvaluator : IAuthorizationEvaluator
{
    private readonly AuthorizationSettings _settings;

    public MyAuthorizationEvaluator(AuthorizationSettings settings)
    {
        _settings = settings;
    }

    public async Task<AuthorizationResult> Evaluate(
        ClaimsPrincipal principal,
        object userContext,
        Dictionary<string, object> inputVariables,
        IEnumerable<string> policies)
    {
        if (policies == null || !policies.Any())
        {
            return AuthorizationResult.Success();
        }

        var context = new AuthorizationContext
        {
            User = principal ?? new ClaimsPrincipal(new ClaimsIdentity()), 
            UserContext = userContext
        };

        return await SatisfiesAtLeastOnePolicyAsync(policies, context) ? 
            AuthorizationResult.Success() : AuthorizationResult.Fail(context.Errors);
    }

    private async Task<bool> SatisfiesAtLeastOnePolicyAsync(IEnumerable<string> policies, AuthorizationContext context )
    {
        var isValid = false;
        foreach (var policy in policies)
        {
            var authorizationPolicy = _settings.GetPolicy(policy);
            if (authorizationPolicy == null)
            {
                context.ReportError($"Required policy '{policy}' is not present.");
                break;
            }

            foreach (var r in authorizationPolicy.Requirements)
            {
                if (await r.AuthorizeAndVerify(context))
                {
                    isValid = true;
                }
            }
        }

        return isValid;
    }
}

public static class AuthorizationRequirementExtensions
{
    public static async Task<bool> AuthorizeAndVerify(this IAuthorizationRequirement requirement, AuthorizationContext context)
    {
        int originalErrorsCount = context.Errors.Count();
        await requirement.Authorize(context);
        if (context.Errors.Count() > originalErrorsCount)
        {
            return false;
        }

        return true;
    }
}

services.AddSingleton<IAuthorizationEvaluator, MyAuthorizationEvaluator>();

context.ReportError($"Required policy '{policy}' is not present.");
isValid = false;
break;