IObjectFieldDescriptor.Authorize ambiguity

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

When passing a single role param into the Authorize extension it selects a policy instead, but adding a 2nd string param will then select the role variation. This can lead to some confusing overload usage.

I think the optional param on the policy should be removed or params remove from the role variation so that its clear which overload is selected.

    {
        public static IObjectFieldDescriptor Authorize(this IObjectFieldDescriptor descriptor, string policy, ApplyPolicy apply = ApplyPolicy.BeforeResolver);
        public static IObjectFieldDescriptor Authorize(this IObjectFieldDescriptor descriptor, params string[] roles);
    }

Steps to reproduce

    public class UserType : ObjectType<User>
    {
        protected override void Configure(IObjectTypeDescriptor<User> descriptor)
        {
            base.Configure(descriptor);
            descriptor.Authorize();
            descriptor.Field(t => t.Password).Authorize("Admin");
        }
    }

Due to params string[] roles and string policy having a optional param, .NET matches the incorrect signature (unless you pass more than one param in).

My suggestion is to remove the optional param or remove params off the role variation.

Relevant log output

No response

Additional Context?

No response

Product

Hot Chocolate

Version

12.9.0

Start by locating AuthorizeObjectFieldDescriptorExtensions and reviewing the two Authorize overloads shown in the issue. Reproduce the UserType example with a single role, then verify the overload behavior for zero, one, and multiple string arguments. Done means the intended role and policy calls are unambiguous, with coverage for the affected cases.