Annotation-based [Authorize] problem for v13

[vlad-karmalytskyi-swi]

I created a separate project for v13 using the copy-paste example from https://chillicream.com/docs/hotchocolate/v13/security/authorization

If I use Code-first approach - I can see schema under localhost:port/graphql/

But for Annotation-based example with [Authorize] attribute, I see the inscription - "Schema unavailable" instead of the scheme.

If I run the query
{
user {
name
address
}
}

an error appears:
{
"name": "ServerParseError",
"statusCode": 500,
"statusText": "",
"bodyText": "HotChocolate.SchemaException: For more details look at the Errors property.

1. Unable to infer or resolve a schema type from the type reference @AuthorizeDirective. (HotChocolate.Types.ObjectType)

   at HotChocolate.Configuration.TypeInitializer.DiscoverTypes()
   at HotChocolate.Configuration.TypeInitializer.Initialize()
   at HotChocolate.SchemaBuilder.Setup.InitializeTypes(SchemaBuilder builder, IDescriptorContext context, IReadOnlyList`1 types)
   at HotChocolate.SchemaBuilder.Setup.Create(SchemaBuilder builder, LazySchema lazySchema, IDescriptorContext context)
   at HotChocolate.SchemaBuilder.Create(IDescriptorContext context)
   at HotChocolate.SchemaBuilder.HotChocolate.ISchemaBuilder.Create(IDescriptorContext context)
   at HotChocolate.Execution.RequestExecutorResolver.CreateSchemaAsync(String schemaName, RequestExecutorSetup options, RequestExecutorOptions executorOptions, IServiceProvider serviceProvider, TypeModuleChangeMonitor typeModuleChangeMonitor, CancellationToken cancellationToken)
   at HotChocolate.Execution.RequestExecutorResolver.CreateSchemaServicesAsync(String schemaName, RequestExecutorSetup options, CancellationToken cancellationToken)
   at HotChocolate.Execution.RequestExecutorResolver.GetRequestExecutorNoLockAsync(String schemaName, CancellationToken cancellationToken)
   at HotChocolate.Execution.RequestExecutorResolver.GetRequestExecutorAsync(String schemaName, CancellationToken cancellationToken)
   at HotChocolate.Execution.RequestExecutorProxy.GetRequestExecutorAsync(CancellationToken cancellationToken)
   at HotChocolate.AspNetCore.HttpPostMiddlewareBase.HandleRequestAsync(HttpContext context)
   at HotChocolate.AspNetCore.HttpPostMiddlewareBase.InvokeAsync(HttpContext context)
   at Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.<>c__DisplayClass20_0.<b__1>d.MoveNext()
   --- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddlewareImpl.Invoke(HttpContext context)

HEADERS

Accept: */
*Host: localhost:7018
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 OPR/95.0.0.0
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Authorization: Basic YXNkOjExMQ==
Cache-Control: max-age=0
Content-Type: application/json
Origin: https://localhost:7018
Referer: https://localhost:7018/graphql/static/js/document.77fc857a.chunk.js
Content-Length: 64
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
"
}

Please help me understand what is missing in the documentation...
(I noticed that the description for Annotation-based approach v12 and v13 are the same)

[PascalSenn]

@vlad-karmalytskyi-swi I've seen this working in several places. Can you provide a reproduction of this issue in a github project?

[vlad-karmalytskyi-swi]

@PascalSenn You can find project here

Also, documentation strongly recommends using HotChocolate.AspNetCore.Authorization.AuthorizeAttribute

But for v13 HotChocolate.AspNetCore.Authorization doesn't contain namespace AuthorizeAttribute, so in this test project I used HotChocolate.Authorization.AuthorizeAttribute

[PascalSenn]

Thanks for reporting this
We need to fix the namespace in the docs in that case

[PascalSenn]

@vlad-karmalytskyi-swi Your Program.cs was wrong. You mixed the minimal API with the old API of .net core. I created a PR that fixes it: vlad-karmalytskyi-swi/HotChocolate-v13-Annotation-based-Authorize-issue#1

[vlad-karmalytskyi-swi]

So, the solution is to move services.AddAuthorization() from Startup > ConfigureServices(IServiceCollection services) to Program.

Thank you, @PascalSenn

PS: If I try to run the suggested code, I got an error
crit: Microsoft.AspNetCore.Hosting.Diagnostics[6]
Application startup exception
System.InvalidOperationException: Unable to resolve service for type 'Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider' while attempting to activate 'Microsoft.AspNetCore.Authentication.AuthenticationMiddleware'.
at Microsoft.Extensions.Internal.ActivatorUtilities.ConstructorMatcher.CreateInstance(IServiceProvider provider)
at Microsoft.Extensions.Internal.ActivatorUtilities.CreateInstance(IServiceProvider provider, Type instanceType, Object[] parameters)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass5_0.b__0(RequestDelegate next)
at Microsoft.AspNetCore.Builder.ApplicationBuilder.Build()
at Microsoft.AspNetCore.Builder.ApplicationBuilder.Build()
at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken)
Unhandled exception. System.InvalidOperationException: Unable to resolve service for type 'Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider' while attempting to activate 'Microsoft.AspNetCore.Authentication.AuthenticationMiddleware'.
at Microsoft.Extensions.Internal.ActivatorUtilities.ConstructorMatcher.CreateInstance(IServiceProvider provider)
at Microsoft.Extensions.Internal.ActivatorUtilities.CreateInstance(IServiceProvider provider, Type instanceType, Object[] parameters)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass5_0.b__0(RequestDelegate next)
at Microsoft.AspNetCore.Builder.ApplicationBuilder.Build()
at Microsoft.AspNetCore.Builder.ApplicationBuilder.Build()
at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken)
at Microsoft.Extensions.Hosting.Internal.Host.StartAsync(CancellationToken cancellationToken)
at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.Run(IHost host)
at Program.

$(String[] args) in D:\Proj\gql-test\Demo\Program.cs:line 16

Where line 16 is "app.run();"

[PascalSenn]

@vlad-karmalytskyi-swi so is this resolved?

[vlad-karmalytskyi-swi]

Yes, in case if move services.AddAuthorization() from Startup > ConfigureServices(IServiceCollection services) to Program and not take Startup > Configure(IApplicationBuilder app, IWebHostEnvironment env)

Thank you.

[vlad-karmalytskyi-swi]

Code here