Operation level authentication and scopes

[susliko]

Hi! 🖖🏻
This PR resolves #2624 by implementing the design doc, but in its initial form:

• @useAuth can now be applied not only to service namespace, but to interfaces and operations as well. Its arguments override all authentication, which was set for enclosing scopes.
• OAuth2 scopes can now be set at operation level (though, the code doing this in OpenAPI emitter is a bit clunky).
• New NoAuth authentication option allows to declare optional authentication (NoAuth | AnyOtherAuth) or override authentication to none in nested scopes.

This implementation does not introduce new @authScopes decorator as design doc comments suggest, and here's why:

1. It does not compose well with @useAuth at operation level. For example

...
@useAuth(BasicAuth)
@authScopes(MyOauth2, ["read"])
op gogo(): void

Should that be equivalent to BasicAuth | MyOauth2, or to [BasicAuth, MyOauth2]?

2. Introducing new decorator would increase complexity, but (imho) it would not reduce the amount of boilerplate:

alias MyOAuth2 = OAuth2Auth<{ ... }>;

@useAuth(MyOAuth2)
@authAcopes(MyOauth2, ["read"])
@service
namepsace Foo;

vs

model MyOAuth2Flow<T extends string[]>  {  ...  };
alias MyOauth2<T extends string[]> = Oauth2Auth<[MyOauth2Flow[T]]>

@useAuth(MyOAuth2<["read"]>)
@service
namepsace Foo

I would be happy to hear any feedback and apply suggested changes.

And thanks for a convenient development setup and thorough test coverage!

[susliko]

@microsoft-github-policy-service agree

[azure-sdk]

❌ There is undocummented changes. Run chronus add to add a changeset or click here.

The following packages have changes but are not documented.

• ❌@typespec/http
• ❌@typespec/openapi3

[azure-sdk]

You can try these changes at https://cadlplayground.z22.web.core.windows.net/prs/2901/

Check the website changes at https://tspwebsitepr.z22.web.core.windows.net/prs/2901/

[timotheeguerin]

Hi @susliko this starts to look pretty good, I think I have a bit of feedback on the new resolve api and what I think might look better. Let me know what you think.

I am trying to review your deviation of the approved design with our team but I am optimistic we should be able to get that approved and merged for the next(march) release.