feat: add async authentication authority and policy evaluation (#107)

* feat: add async authentication authority and policy evaluation

* Add AuthAuthorityTests

Author: mckaragoz

src/CodeBeam.UltimateAuth.Core/Abstractions/Authority/IAuthAuthority.cs

@@ -4,5 +4,14 @@ namespace CodeBeam.UltimateAuth.Core.Abstractions;
 
 public interface IAuthAuthority
 {
-    AccessDecisionResult Decide(AuthContext context, IEnumerable<IAuthorityPolicy>? policies = null);
+    [Obsolete("Synchronous authority evaluation is no longer supported. Use DecideAsync instead.")]
+    AccessDecisionResult Decide(AuthContext context, IEnumerable<IAuthorityPolicy>? policies = null)
+        => throw new NotSupportedException("Synchronous authority evaluation is not supported. Use DecideAsync.");
+
+    ValueTask<AccessDecisionResult> DecideAsync(AuthContext context, IEnumerable<IAuthorityPolicy>? policies = null, CancellationToken ct = default)
+    {
+#pragma warning disable CS0618
+        return ValueTask.FromResult(Decide(context, policies));
+#pragma warning restore CS0618
+    }
 }

src/CodeBeam.UltimateAuth.Core/Abstractions/Authority/IAuthorityInvariant.cs

@@ -5,5 +5,14 @@ namespace CodeBeam.UltimateAuth.Core.Abstractions;
 // TODO: Add ClockSkewInvariant to handle cases where client and server clocks are not synchronized, which can lead to valid tokens being rejected due to "not valid yet" or "expired" errors. This invariant would check the token's "nbf" (not before) and "exp" (expiration) claims against the current time, allowing for a configurable clock skew (e.g., 5 minutes) to accommodate minor discrepancies in system clocks.
 public interface IAuthorityInvariant
 {
-    AccessDecisionResult Decide(AuthContext context);
+    [Obsolete("Implement DecideAsync instead.")]
+    AccessDecisionResult Decide(AuthContext context)
+        => throw new NotSupportedException("Implement DecideAsync for asynchronous invariant evaluation.");
+
+    ValueTask<AccessDecisionResult> DecideAsync(AuthContext context, CancellationToken ct = default)
+    {
+#pragma warning disable CS0618
+        return ValueTask.FromResult(Decide(context));
+#pragma warning restore CS0618
+    }
 }

src/CodeBeam.UltimateAuth.Core/Abstractions/Authority/IAuthorityPolicy.cs

@@ -5,5 +5,15 @@ namespace CodeBeam.UltimateAuth.Core.Abstractions;
 public interface IAuthorityPolicy
 {
     bool AppliesTo(AuthContext context);
-    AccessDecisionResult Decide(AuthContext context);
+
+    [Obsolete("Implement DecideAsync instead.")]
+    AccessDecisionResult Decide(AuthContext context)
+        => throw new NotSupportedException("Implement DecideAsync for asynchronous policy evaluation.");
+
+    ValueTask<AccessDecisionResult> DecideAsync(AuthContext context, CancellationToken ct = default)
+    {
+#pragma warning disable CS0618
+        return ValueTask.FromResult(Decide(context));
+#pragma warning restore CS0618
+    }
 }

src/CodeBeam.UltimateAuth.Core/Infrastructure/Authority/AuthAuthority.cs

@@ -14,11 +14,17 @@ public AuthAuthority(IEnumerable<IAuthorityInvariant> invariants, IEnumerable<IA
         _policies = policies ?? Array.Empty<IAuthorityPolicy>();
     }
 
-    public AccessDecisionResult Decide(AuthContext context, IEnumerable<IAuthorityPolicy>? policies = null)
+    public async ValueTask<AccessDecisionResult> DecideAsync(AuthContext context, IEnumerable<IAuthorityPolicy>? policies = null, CancellationToken ct = default)
     {
+        ct.ThrowIfCancellationRequested();
+
         foreach (var invariant in _invariants)
         {
-            var result = invariant.Decide(context);
+            ct.ThrowIfCancellationRequested();
+
+            var result = await invariant.DecideAsync(
+                context, ct);
+
             if (!result.IsAllowed)
                 return result;
         }
@@ -29,10 +35,12 @@ public AccessDecisionResult Decide(AuthContext context, IEnumerable<IAuthorityPo
 
         foreach (var policy in effectivePolicies)
         {
+            ct.ThrowIfCancellationRequested();
+
             if (!policy.AppliesTo(context))
                 continue;
 
-            var result = policy.Decide(context);
+            var result = await policy.DecideAsync(context, ct);
 
             if (!result.IsAllowed)
                 return result;
@@ -45,5 +53,4 @@ public AccessDecisionResult Decide(AuthContext context, IEnumerable<IAuthorityPo
             ? AccessDecisionResult.Challenge("Additional verification required.")
             : AccessDecisionResult.Allow();
     }
-
 }

src/CodeBeam.UltimateAuth.Core/Infrastructure/Authority/DeviceRequiredInvariant.cs

@@ -6,15 +6,15 @@ namespace CodeBeam.UltimateAuth.Core.Infrastructure;
 
 public sealed class DeviceRequiredInvariant : IAuthorityInvariant
 {
-    public AccessDecisionResult Decide(AuthContext context)
+    public ValueTask<AccessDecisionResult> DecideAsync(AuthContext context, CancellationToken ct = default)
     {
         if (!RequiresDevice(context))
-            return AccessDecisionResult.Allow();
+            return ValueTask.FromResult(AccessDecisionResult.Allow());
 
         if (!context.Device.HasDeviceId)
-            return AccessDecisionResult.Deny("DeviceId is required for this operation.");
+            return ValueTask.FromResult(AccessDecisionResult.Deny("DeviceId is required for this operation."));
 
-        return AccessDecisionResult.Allow();
+        return ValueTask.FromResult(AccessDecisionResult.Allow());
     }
 
     private static bool RequiresDevice(AuthContext context)

src/CodeBeam.UltimateAuth.Core/Infrastructure/Authority/ExpiredSessionInvariant.cs

@@ -6,21 +6,21 @@ namespace CodeBeam.UltimateAuth.Core.Infrastructure;
 
 public sealed class ExpiredSessionInvariant : IAuthorityInvariant
 {
-    public AccessDecisionResult Decide(AuthContext context)
+    public ValueTask<AccessDecisionResult> DecideAsync(AuthContext context, CancellationToken ct = default)
     {
         if (context.Operation == AuthOperation.Login)
-            return AccessDecisionResult.Allow();
+            return ValueTask.FromResult(AccessDecisionResult.Allow());
 
         var session = context.Session;
 
         if (session is null)
-            return AccessDecisionResult.Allow();
+            return ValueTask.FromResult(AccessDecisionResult.Allow());
 
         if (session.State == SessionState.Expired)
         {
-            return AccessDecisionResult.Deny("Session has expired.");
+            return ValueTask.FromResult(AccessDecisionResult.Deny("Session has expired."));
         }
 
-        return AccessDecisionResult.Allow();
+        return ValueTask.FromResult(AccessDecisionResult.Allow());
     }
 }

src/CodeBeam.UltimateAuth.Core/Infrastructure/Authority/InvalidOrRevokedSessionInvariant.cs

@@ -6,25 +6,25 @@ namespace CodeBeam.UltimateAuth.Core.Infrastructure;
 
 public sealed class InvalidOrRevokedSessionInvariant : IAuthorityInvariant
 {
-    public AccessDecisionResult Decide(AuthContext context)
+    public ValueTask<AccessDecisionResult> DecideAsync(AuthContext context, CancellationToken ct = default)
     {
         if (context.Operation == AuthOperation.Login)
-            return AccessDecisionResult.Allow();
+            return ValueTask.FromResult(AccessDecisionResult.Allow());
 
         var session = context.Session;
 
         if (session is null)
-            return AccessDecisionResult.Deny("Session is required for this operation.");
+            return ValueTask.FromResult(AccessDecisionResult.Deny("Session is required for this operation."));
 
         if (session.State == SessionState.Invalid ||
             session.State == SessionState.NotFound ||
             session.State == SessionState.Revoked ||
             session.State == SessionState.SecurityMismatch ||
             session.State == SessionState.DeviceMismatch)
         {
-            return AccessDecisionResult.Deny($"Session state is invalid: {session.State}");
+            return ValueTask.FromResult(AccessDecisionResult.Deny($"Session state is invalid: {session.State}"));
         }
 
-        return AccessDecisionResult.Allow();
+        return ValueTask.FromResult(AccessDecisionResult.Allow());
     }
 }

src/CodeBeam.UltimateAuth.Core/Infrastructure/Authority/TenantResolvedInvariant.cs

@@ -5,13 +5,14 @@ namespace CodeBeam.UltimateAuth.Core.Infrastructure;
 
 public sealed class TenantResolvedInvariant : IAuthorityInvariant
 {
-    public AccessDecisionResult Decide(AuthContext context)
+    public ValueTask<AccessDecisionResult> DecideAsync(AuthContext context, CancellationToken ct = default)
     {
-        if (context.Tenant.IsUnresolved)
-        {
-            return AccessDecisionResult.Deny("Tenant is not resolved.");
-        }
+        ct.ThrowIfCancellationRequested();
 
-        return AccessDecisionResult.Allow();
+        var result = context.Tenant.IsUnresolved
+            ? AccessDecisionResult.Deny("Tenant is not resolved.")
+            : AccessDecisionResult.Allow();
+
+        return ValueTask.FromResult(result);
     }
 }

src/CodeBeam.UltimateAuth.Server/Infrastructure/Orchestrator/UAuthSessionOrchestrator.cs

@@ -23,7 +23,7 @@ public async Task<TResult> ExecuteAsync<TResult>(AuthContext authContext, ISessi
 
         _executed = true;
 
-        var decision = _authority.Decide(authContext);
+        var decision = await _authority.DecideAsync(authContext, ct: ct);
 
         switch (decision.Decision)
         {

tests/CodeBeam.UltimateAuth.Tests.Integration/AuthorizationManagementTests.cs

@@ -33,8 +33,7 @@ public async Task AssignRole_TargetMismatch_ShouldRejectWithoutMutation()
         var target = await factory.CreateLoginUserAsync();
         var other = await factory.CreateLoginUserAsync();
 
-        await GrantAsync(factory, admin,
-            UAuthActions.Authorization.Roles.AssignAdmin);
+        await GrantAsync(factory, admin, UAuthActions.Authorization.Roles.AssignAdmin);
 
         var role = await SeedRoleAsync(factory);