Support AuthorizationPolicy and IAuthorizationRequirementData metadata everywhere

[javiercn]

Summary

Fixes #63365.

Only the AuthorizationMiddleware (endpoint routing) honored all three kinds of authorization endpoint metadata:

• IAuthorizeData  (e.g. [Authorize])
• AuthorizationPolicy instances used directly as metadata, relevant to routing only
• IAuthorizationRequirementData (e.g. a custom attribute carrying requirements)

Other places that make the same authorization decision ignored those metadata types:

• MVC AuthorizeFilter  (GetEffectivePolicyAsync)
• SignalR HubMethodDescriptor  (previously gathered Policies only)
• Blazor AuthorizeViewCore/ AuthorizeRouteView (didn't consider IAuthorizationRequirementData)

The legacy non-endpoint-routing path (EnableEndpointRouting=false  + UseMvc) is a deliberately-frozen, opt-out code path untouched for ~7 years, so extending it isn't worth the risk.

This PR adds a higher-level API that takes all the metadata associated with an endpoint and returns the effective policy, then routes the existing sites through it.

New API

namespace Microsoft.AspNetCore.Authorization;

public class AuthorizationPolicy
{
    public static Task<AuthorizationPolicy?> CombineAsync(
        IAuthorizationPolicyProvider policyProvider,
        IEnumerable<object> metadata);
}

The overload inspects each metadata item and combines any IAuthorizeData, AuthorizationPolicy, and IAuthorizationRequirementData instances into a single effective policy. A single item (for example an attribute) that implements more than one of these interfaces contributes to each. The requirement-data handling that previously lived in AuthorizationMiddleware now lives in a shared code path so behavior is identical.

Changes

• AuthorizationMiddleware: refactor - replace the existing correct logic with the new shared method call.
• MVC AuthorizeFilter: endpoint-routing now passes the whole endpoint.Metadata instead of just IAuthorizeData, so that AuthorizationPolicyandIAuthorizationRequirementData` are honored.
• SignalR- previously it gathered only policy names. Not it collects the full authorization metadata of hub method attributes and combines with the new shared API.
• Blazor: previously only honored IAuthorizeData, now also IAuthorizationRequirementData, using the new API to combine them.

Tests

Subsystem	Allow (positive)	Deny (negative)	Metadata kinds exercised	Test location
Core CombineAsync	✅ ×4 + null	—	IAuthorizeData, IAuthorizationRequirementData, AuthorizationPolicy instance, both-interfaces dedup	AuthorizationPolicyFacts.cs
SignalR	✅	✅	IAuthorizationRequirementData	HubConnectionHandlerTests.cs
MVC (AuthorizeFilter)	✅	✅	IAuthorizationRequirementData, AuthorizationPolicy instance	AuthorizeFilterTest.cs
Blazor (AuthorizeView)	✅	✅	IAuthorizationRequirementData	AuthorizeViewTest.cs
Middleware	(existing)	(existing)	all (refactor only)	pre-existing middleware tests

[Copilot]

Pull request overview

This PR centralizes authorization-policy computation so all callers (middleware, MVC filters, SignalR hub method dispatch, and Blazor components) honor the same endpoint authorization metadata types: IAuthorizeData, AuthorizationPolicy metadata instances, and IAuthorizationRequirementData.

Changes:

• Add AuthorizationPolicy.CombineAsync(IAuthorizationPolicyProvider, IEnumerable<object> metadata) to compute an effective policy from mixed endpoint metadata.
• Refactor authorization evaluation sites (middleware, MVC AuthorizeFilter, SignalR hub dispatch, Blazor AuthorizeViewCore/AuthorizeRouteView) to use the shared combine logic.
• Add/extend tests across Authorization, MVC, SignalR, and Components to cover IAuthorizationRequirementData and policy-instance metadata.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/Security/Authorization/Core/src/AuthorizationPolicy.cs	Adds new CombineAsync overload that inspects endpoint metadata and merges requirements consistently.
src/Security/Authorization/Policy/src/AuthorizationMiddleware.cs	Replaces in-middleware metadata handling with the new shared CombineAsync(metadata) overload.
src/Security/Authorization/test/AuthorizationPolicyFacts.cs	Adds unit tests for new metadata-based policy combination behavior.
src/Security/Authorization/Core/src/PublicAPI/net11.0/PublicAPI.Unshipped.txt	Declares the new AuthorizationPolicy.CombineAsync(..., IEnumerable<object>) API for shipping.
src/Mvc/Mvc.Core/src/Authorization/AuthorizeFilter.cs	Updates endpoint-routing path to combine the full endpoint.Metadata instead of only IAuthorizeData.
src/Mvc/Mvc.Core/test/Authorization/AuthorizeFilterTest.cs	Adds MVC tests validating requirement-data and policy-instance endpoint metadata are enforced.
src/SignalR/server/Core/src/Internal/HubMethodDescriptor.cs	Stores full authorization metadata (not just IAuthorizeData) for hub methods.
src/SignalR/server/Core/src/Internal/DefaultHubDispatcher.cs	Discovers and evaluates hub authorization from combined metadata via shared CombineAsync.
src/SignalR/server/SignalR/test/.../Hubs.cs	Adds a test-only IAuthorizationRequirementData attribute requiring NameIdentifier claim.
src/SignalR/server/SignalR/test/.../HubConnectionHandlerTests.cs	Adds SignalR tests ensuring hub method requirement-data metadata is honored.
src/Components/Authorization/src/AuthorizeViewCore.cs	Adds virtual requirement-data hook and combines metadata for Blazor component authorization.
src/Components/Authorization/src/AuthorizeRouteView.cs	Flows requirement-data attributes from routed page types into authorization evaluation.
src/Components/Authorization/src/AttributeAuthorizeDataCache.cs	Extends attribute cache to track both IAuthorizeData and IAuthorizationRequirementData.
src/Components/Authorization/src/PublicAPI.Unshipped.txt	Declares new AuthorizeViewCore.GetAuthorizationRequirementData() API.
src/Components/Authorization/test/AuthorizeViewTest.cs	Adds Blazor tests validating requirement-data metadata is passed to authorization.