Support authorization on Apollo Federation _entities query

Product

Hot Chocolate

Is your feature request related to a problem?

I want to use a .NET AuthorizationHandler to authorize entity resolution, that is, calls to the _entities query.

I have successfully set up .NET authorization in a project so that regular methods of the top-level Query class, annotated with [Authorize("SomeRequirement")], are getting authorized as expected.

There seems to be no way in the current stable version (13.5.1 at the time of this writing) to make that authorization apply to the _entities query. Here are the things I've tried:

• Annotating the entity resolver class and/or method with [Authorize("SomeRequirement")]. This is the method registered with ResolveReferenceWith for the GraphQL type.
• Annotating the GraphQL entity type with [Authorize("SomeRequirement")]
• Annotation the top-level Query class with [Authorize("SomeRequirement")]. This results in an extra authorization call for regular methods in the Query class (one because of the annotation on the class and one because of the annotation on the method).

Using any of the methods above calling the _entities query does not trigger any authorization, as far as I can tell.

I've spent some time trying to understand how HotChocolate .NET authorization works, and it seems that for the _entities query that AuthorizationTypeInterceptor is not getting triggered.

It's entirely possible that I'm missing something obvious to make this work. If so, just close this issue with a comment pointing to some sample code and I'll be very grateful!

The solution you'd like

I want to be able to authorize Apollo Federation entity resolution (the _entities query) the same way as regular queries.

Start with src/HotChocolate/Core/src/Authorization/AuthorizationTypeInterceptor.cs and the federation _entities/ResolveReferenceWith path described in the issue. Reproduce the authorization setup against Hot Chocolate 13.5.1, then verify that an [Authorize] requirement invokes the .NET AuthorizationHandler during entity resolution without duplicate regular-query checks.