Release v22.21.0

Added

• Analyzer ARC0021 reports a Policy or AuthenticationSchemes on an authorization attribute of a model-bound command or read model. Arc enforces authentication and roles but evaluates neither of these, so the artifact is less protected than its attribute reads (#2736)
• IAuthorizationAttributeEvaluator.GetAuthorizationRequirements, so an evaluator can report every attribute it finds. It defaults to the existing single answer, so existing implementations keep working

Changed

• Analyzer ARC0020 now reports an ASP.NET Core authorization attribute only in a project without Arc's ASP.NET Core integration (Cratis.Arc), since that integration now enforces it (#2719)

Fixed

• The authorization attribute evaluator specs could not fail: a null-conditional assertion skipped the assertion whenever the evaluator found nothing

Security

• [Authorize] and [AllowAnonymous] from Microsoft.AspNetCore.Authorization are enforced again on model-bound commands and read models when Arc is hosted on ASP.NET Core. Since v18.2.0 a model-bound artifact protected only with Microsoft's [Authorize] was open to every caller — over HTTP, over hub subscriptions and through direct pipeline execution — because the evaluators meant to honour it read Arc's same-named attributes instead (#2719)
• Every authorization attribute on a declaration now applies. Previously only the first one found was evaluated, so a second, stacked requirement — [Roles("Admin")] together with [Authorize(Roles = "Auditor")] — was silently dropped
• A declaration marked both [AllowAnonymous] and [Authorize]/[Roles] is always rejected as ambiguous. Previously it either threw or admitted anonymous callers depending on which evaluator was discovered first (#2714)