Support for role-based authorization

[Matasx]

Hello again, 😄
with the build-in functionality I was able to implement user authentication quite easily.
Now I'm after role based authorization. I haven't seen anything related to authorization in GenHTTP, hence my ask.

I was able to provide my custom authenticated user object which contains set of effective roles and in particular endpoints I want to do a pre-check that the user has a particular role granted. Ideally this could happen before the request is routed to a handling method and before the payload is parsed to save some compute time (but not required). I'm using webservice approach. So I was thinking about some custom attribute to decorate my methods with the required role, but I don't know how or if this can be plugged to the existing functionality. Could you please steer me in the right direction?

This is what I have at the moment, particularly I don't like that I have to add a reference to the full IRequest in each method, I would like to avoid this.

        [ResourceMethod(RequestMethod.POST, "user")]
        public void CreateUser(UserRecord user, IRequest request)
        {
            request.Authorize(Roles.AuthAdmin);
            _controller.CreateUser(user);
        }

Under the hoods my Authorize method is quite simple:

request.GetUser<AuthUser>().Roles.Contains(role)
// ... and throw Provider Exception if not

This is what I would like to have instead:

        [ResourceMethod(RequestMethod.POST, "user")]
        [ProtectedMethod(Roles.AuthAdmin)]
        public void CreateUser(UserRecord user)
        {
            _controller.CreateUser(user);
        }

Thank you in advance for any suggestions.

[Kaliumhexacyanoferrat]

Thanks for your question - this one is tough to be solved without changing the framework itself because the MethodHandler functionality cannot be influenced by IConcern instances (at least not without deep reflection hacks in place).

Regarding the IRequest which needs to be referenced I would solve this in #317 by allowing the IUser instance to be injected instead.

Regarding the role check, adding concerns to the MethodHandler would be an option, but adds another layer with additional complexity and reduced reusability. Another solution would be allowing IConcern to peek the actual IHandler instance which would be executed and fetch the annotated attributes from there - but this feels some kind of hacky as well. Have to think about this one ...

[Matasx]

Thank you for the thought. Having the ability to inject the authenticated user would be at least a minor improvement. I just did not wanted to pollute my code with some anti-pattern if there is a better solution. If that's not the case, I'm fine. Looking forward if you can come up with further improvements. Thanks!

[Kaliumhexacyanoferrat]

As announced, in GenHTTP 7 you will be able to inject the user instance as a start.

[Kaliumhexacyanoferrat]

Role-based authorization is one of the next focus topics, see #561

[Kaliumhexacyanoferrat]

I think we successfully made this available in 9.3, so I will close here 😉