Using dependency injection in AuthorizationRequirement

[joacoleza]

Hi, as I need one registered service to evaluate the authorization, is there a way to use Dependency Injection when implementing IAuthorizationRequirement ?

I want to achieve something similar to handlers in in ASP.NET Core.

Thanks!

[joacoleza]

I ended adding to my GraphQLUserContext (which implements IProvideClaimsPrincipal) a HttpContext property. This property is being set when constructing it on the GraphQLUserContextBuilder (as HttpContext is a parameter of the method BuildUserContext).

Then, when implementing my IAuthorizationRequirement on the Authorize method I can access the registered service from the HttpContext doing:

HttpContext httpContext = ((GraphQLUserContext)context.UserContext).HttpContext;
var myService = (IMyService)httpContext.RequestServices.GetService(typeof(IMyService));

Is there a better way of doing so?

[joemcbride]

Here's an alternative way to do it:

public class MyReq : IAuthorizationRequirement
{
    private readonly IHttpContextAccessor accessor;

    public MyReq(IHttpContextAccessor accessor)
    {
        this.accessor = accessor;
    }

    public Task Authorize(AuthorizationContext context)
    {
        return Task.CompletedTask;
    }
}

public static class GraphQLAuthExtensions
{
    public static void AddGraphQLAuth(this IServiceCollection services, Action<AuthorizationSettings, IServiceProvider> configure)
    {
        services.AddHttpContextAccessor();
        services.AddTransient<IAuthorizationEvaluator, AuthorizationEvaluator>();
        services.AddTransient<IValidationRule, AuthorizationValidationRule>();
        services.AddTransient<MyReq>();

        services.TryAddTransient(s =>
        {
            var authSettings = new AuthorizationSettings();
            configure(authSettings, s);
            return authSettings;
        });
    }
}

public void ConfigureServices(IServiceCollection services)
{
    services.AddGraphQLAuth((_, s) =>
    {
        _.AddPolicy("SomePolicy", p => p.AddRequirement(s.GetService<MyReq>()));
    });
}

[sungam3r]

Instead of

   services.TryAddSingleton<IHttpContextAccessor, HttpContextAccessor>();

you can use special method

  services.AddHttpContextAccessor();

from Microsoft.AspNetCore.Http what does exacly the same thing.

[joemcbride]

I updated IAuthorizationEvaluator in the example to be registered as Transient. Otherwise AuthorizationSettings would become a singleton indirectly.

[sungam3r]

Enabling scope validation on DI-container may help to find such problems.

[joacoleza]

Here's an alternative way to do it:

public class MyReq : IAuthorizationRequirement
{
    private readonly IHttpContextAccessor accessor;

    public MyReq(IHttpContextAccessor accessor)
    {
        this.accessor = accessor;
    }

    public Task Authorize(AuthorizationContext context)
    {
        return Task.CompletedTask;
    }
}

public static class GraphQLAuthExtensions
{
    public static void AddGraphQLAuth(this IServiceCollection services, Action<AuthorizationSettings, IServiceProvider> configure)
    {
        services.AddHttpContextAccessor();
        services.AddTransient<IAuthorizationEvaluator, AuthorizationEvaluator>();
        services.AddTransient<IValidationRule, AuthorizationValidationRule>();
        services.AddTransient<MyReq>();

        services.TryAddTransient(s =>
        {
            var authSettings = new AuthorizationSettings();
            configure(authSettings, s);
            return authSettings;
        });
    }
}

public void ConfigureServices(IServiceCollection services)
{
    services.AddGraphQLAuth((_, s) =>
    {
        _.AddPolicy("SomePolicy", p => p.AddRequirement(s.GetService<MyReq>()));
    });
}

Thanks! I'll do it this way

[mmmikeal]

this is incredibly helpful @joacoleza , do you have an example of how you added the service you want injected to the httpcontext and how you retrieve it out of the httpcontext? i am getting some type errors

[mmmikeal]

for example in my AddGraphQLAuth i have

services.AddHttpContextAccessor(); services.AddTransient<MyServiceToBeInjected>();

and in my requirement i attempt to access it by
var service = accessor.HttpContext.RequestServices.GetService<MyServiceToBeInjected>();

[joacoleza]

this is incredibly helpful @joacoleza , do you have an example of how you added the service you want injected to the httpcontext and how you retrieve it out of the httpcontext? i am getting some type errors

I no longer have access to the code where this was implemented. Sorry I couldn’t be more help.