Added policy interfaces - #10008
Open
michaelstaib wants to merge 10 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces first-class support for authorization policy directives in Fusion composition and execution by (1) merging user @policy directives (including interface-to-implementor propagation), (2) stamping them into @fusion__policy in the composed schema, and (3) exposing parsed policy applications on Fusion object/field definitions for execution-time use.
Changes:
- Add composition support for
@policy(merge + dedupe + propagate from interfaces) and stamp results as@fusion__policy. - Add execution schema support for parsing/storing
@fusion__policyapplications on object types and fields, plus a schema-levelHasPoliciesflag. - Introduce policy runtime interfaces (
IAuthorizationPolicy/IAuthorizationContext) and add targeted tests in both composition and execution layers.
Reviewed changes
Copilot reviewed 22 out of 22 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/HotChocolate/Fusion/test/Fusion.Execution.Tests/Execution/Types/PolicyApplicationsTests.cs | Adds execution-layer tests validating parsing/storage of @fusion__policy applications and HasPolicies. |
| src/HotChocolate/Fusion/test/Fusion.Composition.Tests/SourceSchemaMerger.PolicyDirective.Tests.cs | Adds composition-layer tests for stamping, interface propagation, and deduping behavior. |
| src/HotChocolate/Fusion/src/Fusion.Execution/Execution/Policies/IAuthorizationPolicy.cs | Introduces policy evaluation interfaces and an entity container for policy evaluation. |
| src/HotChocolate/Fusion/src/Fusion.Execution.Types/PolicyDenialBehavior.cs | Adds runtime enum describing denial behavior semantics (Null/Error/Abort). |
| src/HotChocolate/Fusion/src/Fusion.Execution.Types/PolicyApplication.cs | Adds runtime model representing a single policy application on a coordinate. |
| src/HotChocolate/Fusion/src/Fusion.Execution.Types/FusionSchemaDefinition.cs | Adds HasPolicies and computes it during schema sealing based on stored applications. |
| src/HotChocolate/Fusion/src/Fusion.Execution.Types/FusionOutputFieldDefinition.cs | Adds PolicyApplications to output field definitions and wires it from completion context. |
| src/HotChocolate/Fusion/src/Fusion.Execution.Types/FusionObjectTypeDefinition.cs | Adds PolicyApplications to object type definitions and wires it from completion context. |
| src/HotChocolate/Fusion/src/Fusion.Execution.Types/FusionBuiltIns.cs | Adds fusion__policy built-in directive name constant. |
| src/HotChocolate/Fusion/src/Fusion.Execution.Types/Completion/CompositeSchemaBuilder.cs | Parses @fusion__policy directives into PolicyApplication collections during completion. |
| src/HotChocolate/Fusion/src/Fusion.Execution.Types/Completion/CompositeOutputFieldCompletionContext.cs | Extends field completion context to carry policy applications. |
| src/HotChocolate/Fusion/src/Fusion.Execution.Types/Completion/CompositeObjectTypeCompletionContext.cs | Extends object completion context to carry policy applications. |
| src/HotChocolate/Fusion/src/Fusion.Composition/WellKnownTypeNames.cs | Adds well-known type names for policy denial behavior (user + fusion enum). |
| src/HotChocolate/Fusion/src/Fusion.Composition/WellKnownDirectiveNames.cs | Adds well-known directive names for policy and fusion__policy. |
| src/HotChocolate/Fusion/src/Fusion.Composition/WellKnownArgumentNames.cs | Adds onDenied argument constant for policy directives. |
| src/HotChocolate/Fusion/src/Fusion.Composition/SourceSchemaMerger.cs | Implements policy directive merging, interface-policy propagation, and stamping to @fusion__policy; adds fusion enum/ ನಿರ್ದೇಶive definitions. |
| src/HotChocolate/Fusion/src/Fusion.Composition/Directives/PolicyDirective.cs | Adds parsed representation of user @policy directives. |
| src/HotChocolate/Fusion/src/Fusion.Composition/DirectiveMergers/PolicyDirectiveMerger.cs | Adds merger logic: collect, dedupe by name, choose “max” denial behavior. |
| src/HotChocolate/Fusion/src/Fusion.Composition/Definitions/PolicyMutableDirectiveDefinition.cs | Defines canonical user @policy directive (repeatable, object/interface/field). |
| src/HotChocolate/Fusion/src/Fusion.Composition/Definitions/PolicyDenialBehaviorMutableEnumTypeDefinition.cs | Defines user-facing PolicyDenialBehavior enum for @policy. |
| src/HotChocolate/Fusion/src/Fusion.Composition/Definitions/FusionPolicyMutableDirectiveDefinition.cs | Defines @fusion__policy directive for composed schema stamping. |
| src/HotChocolate/Fusion/src/Fusion.Composition/Definitions/FusionPolicyDenialBehaviorMutableEnumTypeDefinition.cs | Defines fusion__PolicyDenialBehavior enum for @fusion__policy. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+1517
to
+1539
| private static void AddFusionPolicyDirectives( | ||
| IDirectivesProvider member, | ||
| IReadOnlyList<PolicyDirective> policies, | ||
| MutableDirectiveDefinition directiveDefinition) | ||
| { | ||
| foreach (var policy in policies) | ||
| { | ||
| var arguments = new List<ArgumentAssignment> | ||
| { | ||
| new(ArgumentNames.Name, policy.Name) | ||
| }; | ||
|
|
||
| if (policy.OnDenied != "NULL") | ||
| { | ||
| arguments.Add( | ||
| new ArgumentAssignment( | ||
| ArgumentNames.OnDenied, | ||
| new EnumValueNode(policy.OnDenied))); | ||
| } | ||
|
|
||
| member.AddDirective(new Directive(directiveDefinition, arguments)); | ||
| } | ||
| } |
# Conflicts: # src/HotChocolate/Fusion/src/Fusion.Composition/SourceSchemaMerger.cs # src/HotChocolate/Fusion/src/Fusion.Composition/WellKnownTypeNames.cs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.