ASP.NET Core Blazor Server でクレームベースの承認とポリシーベースの承認をする

using System.ComponentModel.DataAnnotations;
using System.Security.Claims;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.RazorPages;

namespace AuthBlazorServerApp.Areas.MySignin.Pages;

public class IndexModel : PageModel
{
    [BindProperty]
    [Required]
    public string? UserName { get; set; }
    public async Task<IActionResult> OnPost()
    {
        if (ModelState.IsValid is false) return Page();

        var userName = UserName!;
        var principal = new ClaimsPrincipal(new ClaimsIdentity(
            CreateClaims(userName),
            CookieAuthenticationDefaults.AuthenticationScheme));
        await HttpContext.SignInAsync(
            CookieAuthenticationDefaults.AuthenticationScheme,
            principal);
        return Redirect("/");
    }

    private IEnumerable<Claim> CreateClaims(string userName)
    {
        yield return new Claim(ClaimTypes.Name, userName);
        yield return new Claim(ClaimTypes.Role, "User");
        if (userName == "Admin")
        {
            yield return new Claim(ClaimTypes.Role, "Administrator");
        }

        yield return userName switch
        {
            "Admin" => new Claim("EmployeeNumber", "0001"),
            "Kazuki" => new Claim("EmployeeNumber", "0011"),
            "Shinji" => new Claim("EmployeeNumber", "0111"),
            "Kazuaki" => new Claim("EmployeeNumber", "1111"),
            _ => new Claim("EmployeeNumber", "9999"),
        };
    }
}

builder.Services.AddAuthorization(options =>
{
    // EmployeeNumber が 0001 か 0011 の人のみ通すポリシー
    options.AddPolicy("EmployeeNumberIs0001Or0011", builder =>
    {
        builder.RequireClaim("EmployeeNumber", "0001", "0011");
    });
});

@page "/fetchdata"
@attribute [Authorize(Policy = "EmployeeNumberIs0001Or0011")]

<PageTitle>Weather forecast</PageTitle>
@* 以下省略 *@

using Microsoft.AspNetCore.Authorization;

namespace AuthBlazorServerApp.Auth;

public class TestRequirement : IAuthorizationRequirement
{
}

using Microsoft.AspNetCore.Authorization;

namespace AuthBlazorServerApp.Auth;

public class TestAuthHandler : AuthorizationHandler<TestRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, TestRequirement requirement)
    {
        // EmployeeNumber の Claim があって
        var employeeNumberClaim = context.User.Claims.FirstOrDefault(x => x.Type == "EmployeeNumber");
        if (employeeNumberClaim is null) return Task.CompletedTask;

        // 右から 3 桁目が 1 だったら OK (EmployeeNumber は 4 桁想定なので index = 1 が 3 桁目)
        if (employeeNumberClaim.Value.Length == 4 && employeeNumberClaim.Value[1] == '1')
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }
}

// カスタムのハンドラー！
builder.Services.AddSingleton<IAuthorizationHandler, TestAuthHandler>(); // Scoped でも Transient でも可

builder.Services.AddAuthorization(options =>
{
    // EmployeeNumber が 0001 か 0011 の人のみ通すポリシー
    options.AddPolicy("EmployeeNumberIs0001Or0011", builder =>
    {
        builder.RequireClaim("EmployeeNumber", "0001", "0011");
    });

    // Test という名前のポリシーを登録
    options.AddPolicy("Test", builder =>
    {
        // ここで IAuthorizationRequirement を実装したクラスを設定する。
        builder.AddRequirements(new TestRequirement());
    });

    // デフォルトで認証されたユーザーが必要
    options.FallbackPolicy = options.DefaultPolicy;
});

@page "/fetchdata"
@attribute [Authorize(Policy = "Test")]

<PageTitle>Weather forecast</PageTitle>

@* 以下略 *@

<AuthorizeRouteView Resource="@routeData" RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">

using System.Security.Claims;
using Microsoft.AspNetCore.Authorization;

namespace AuthBlazorServerApp.Data;

public class WeatherForecastService
{
    private static readonly string[] Summaries = new[]
    {
        "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
    };
    private readonly IAuthorizationService _authorizationService;

    public WeatherForecastService(IAuthorizationService authorizationService)
    {
        _authorizationService = authorizationService;
    }

    public async Task<WeatherForecast[]> GetForecastAsync(DateTime startDate, ClaimsPrincipal user)
    {
        // ユーザーが Test ポリシーを満たしているかどうか
        var result = await _authorizationService.AuthorizeAsync(user, "Test");
        return Enumerable.Range(1, 5).Select(index => new WeatherForecast
        {
            Date = startDate.AddDays(index),
            TemperatureC = Random.Shared.Next(-20, 55),
            // Test ポリシーを満たしているなら全データを Warm にする
            Summary = result.Succeeded ? "Warm" : Summaries[Random.Shared.Next(Summaries.Length)]
        }).ToArray();
    }
}

@* 上のマークアップ部分は省略 *@

@code {
    [CascadingParameter]
    private Task<AuthenticationState> AuthenticationState { get; set; } = null!;

    private WeatherForecast[]? forecasts;

    protected override async Task OnInitializedAsync()
    {
        var authState = await AuthenticationState;
        forecasts = await ForecastService.GetForecastAsync(DateTime.Now, authState.User);
    }
}

var result = await _authorizationService.AuthorizeAsync(user, new AuthorizationPolicy(
    new[] { new TestRequirement() }, // requirement
    Enumerable.Empty<string>())); // aithenticationSchemas