Skip to content

Release v22.20.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Sep 19:47
v22.20.0
843e622
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Analyzer ARC0019 reports [AllowAnonymous] declared on the same class or method as [Authorize] or [Roles]. Arc resolves that contradiction differently depending on evaluator order — rejecting the call in one order and admitting anonymous callers in the other — so the declaration now fails loudly at build time instead. Overriding a class on one query method is supported and not reported (#2714)
  • Analyzer ARC0020 reports [Authorize] or [AllowAnonymous] from Microsoft.AspNetCore.Authorization on a model-bound [Command] or [ReadModel]. Arc enforces only its own Cratis.Arc.Authorization attributes on model-bound artifacts, so the ASP.NET Core attribute protects nothing: a command marked with it is open to every caller. Use the Arc attribute of the same name. Controller-based commands and queries are unaffected (#2719)

Both rules are warnings. A project that treats warnings as errors will fail to build where either applies — which, for ARC0020, is a command or query that is currently unprotected.

Assets 2
Loading