Skip to content

Add Azure Functions authentication boundary - #822

Merged
AndreaCuneo merged 6 commits into
masterfrom
copilot/azure-function-progress
Aug 2, 2026
Merged

Add Azure Functions authentication boundary#822
AndreaCuneo merged 6 commits into
masterfrom
copilot/azure-function-progress

Conversation

Copilot AI commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Azure Functions needed authentication parity with the existing HTTP transport while ASP.NET Core middleware is unavailable in isolated-worker hosting.

  • Authentication

    • Added configurable bearer/Easy Auth profile options.
    • Generated endpoints authenticate through IAuthenticationService.
    • Enforced AllowAnonymous and returned standard challenge results.
    • Propagated authenticated principals to HttpContext.User.

  • Generator

    • Emits authentication checks before binding and handler dispatch.
var challenge = await ArkAzureFunctionsInvocation
    .AuthenticateAsync(request.HttpContext, allowAnonymous: false);

if (challenge is not null)
    return challenge;
  • Documentation
    • Recorded the decision to keep application authentication at the generated function boundary.
    • Documented FunctionContext middleware as suitable for worker-level concerns, not ASP.NET authentication.

Copilot AI and others added 5 commits August 2, 2026 17:07
@AndreaCuneo
feat(mediator): wire Functions endpoint authentication
9185815 
Co-authored-by: AndreaCuneo <5227688+AndreaCuneo@users.noreply.github.com>
@AndreaCuneo
fix(mediator): correct Functions challenge result
eafd707 
Co-authored-by: AndreaCuneo <5227688+AndreaCuneo@users.noreply.github.com>
@AndreaCuneo
test(mediator): complete Functions auth stub
0ea4987 
Co-authored-by: AndreaCuneo <5227688+AndreaCuneo@users.noreply.github.com>
@AndreaCuneo
test(mediator): fix authentication ticket setup
28bd27e 
Co-authored-by: AndreaCuneo <5227688+AndreaCuneo@users.noreply.github.com>
@AndreaCuneo
docs(mediator): clarify Functions worker middleware
738653a 
Co-authored-by: AndreaCuneo <5227688+AndreaCuneo@users.noreply.github.com>
@AndreaCuneo
AndreaCuneo marked this pull request as ready for review August 2, 2026 17:22
@AndreaCuneo
AndreaCuneo requested a review from a team as a code owner August 2, 2026 17:22
Copilot AI review requested due to automatic review settings August 2, 2026 17:22
Copilot AI reviewed Aug 2, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds an authentication boundary for generated Azure Functions endpoints (isolated worker) by invoking ASP.NET Core authentication (IAuthenticationService) inside the generated function body, plus accompanying configuration hooks, tests, and design/decision documentation.

Changes:

  • Added ArkAzureFunctionsInvocation.AuthenticateAsync(...) and generator emission so each generated function authenticates (and challenges) before binding/dispatch.
  • Introduced DI registration helper for Azure Functions authentication options/scheme and added snapshot/runtime tests around anonymous metadata + challenge behavior.
  • Documented the design decision to keep authentication at the generated function boundary rather than worker middleware.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
tests/Ark.Tools.MediatorFramework.Tests/GeneratorSnapshotTests.cs Adds generator/runtime tests for anonymous metadata and challenge behavior.
src/mediator-framework/Ark.Tools.MediatorFramework.AzureFunctions/ArkAzureFunctionsServiceCollectionExtensions.cs Adds AddArkAzureFunctionsAuthentication(...) registration helper.
src/mediator-framework/Ark.Tools.MediatorFramework.AzureFunctions/ArkAzureFunctionsInvocation.cs Adds the runtime authentication helper used by generated functions.
src/mediator-framework/Ark.Tools.MediatorFramework.AzureFunctions/ArkAzureFunctionsAuthenticationOptions.cs Introduces authentication options and a profile enum (DirectBearer/EasyAuth).
src/mediator-framework/Ark.Tools.MediatorFramework.AzureFunctions.Generators/AzureFunctionsEndpointGenerator.cs Emits authentication checks and propagates AllowAnonymous metadata into generation.
docs/mediator-framework/progress/tasks/README.md Updates progress checklist.
docs/mediator-framework/progress/azure-functions-decision-log.md Records the auth-boundary decision (AZD-12).
docs/mediator-framework/azure-functions-design.md Updates design notes about worker middleware vs generated auth boundary.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread ...mediator-framework/Ark.Tools.MediatorFramework.AzureFunctions/ArkAzureFunctionsInvocation.cs Outdated
Comment on lines +35 to +53
if (allowAnonymous)
{
context.User ??= new System.Security.Claims.ClaimsPrincipal(new System.Security.Claims.ClaimsIdentity());
return null;
}

var authentication = context.RequestServices.GetService<IAuthenticationService>()
?? throw new InvalidOperationException(
"The Azure Functions authentication service is not registered. Configure ASP.NET Core authentication.");
var options = context.RequestServices.GetService<IOptions<ArkAzureFunctionsAuthenticationOptions>>()?.Value;
var scheme = options?.Scheme;
var result = await authentication.AuthenticateAsync(context, scheme).ConfigureAwait(false);
if (!result.Succeeded || result.Principal is null)
return Results.Challenge(
authenticationSchemes: scheme is null ? null : new[] { scheme });

context.User = result.Principal;
return null;
}
Comment thread ...amework/Ark.Tools.MediatorFramework.AzureFunctions/ArkAzureFunctionsAuthenticationOptions.cs Outdated
Comment on lines +19 to +23
/// <summary>Gets or sets the authentication profile.</summary>
public ArkAzureFunctionsAuthenticationProfile Profile { get; set; }

/// <summary>
/// Gets or sets the authentication scheme. <see langword="null"/> uses the host default scheme.
@AndreaCuneo

AndreaCuneo commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

@AndreaCuneo
fix(AzureFunctions): always authenticate to populate user; remove uni…
c07588f 
…mplemented Profile enum

Co-authored-by: AndreaCuneo <5227688+AndreaCuneo@users.noreply.github.com>
Copilot AI requested review from Copilot and removed request for Copilot August 2, 2026 17:33

Copilot AI commented Aug 2, 2026

Copy link
Copy Markdown
Contributor Author

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the...

Fixed in the latest commit:

  1. AuthenticateAsync — now always calls IAuthenticationService.AuthenticateAsync when the service is registered, populating HttpContext.User on success even for anonymous endpoints. The challenge is only returned when allowAnonymous is false.

  2. ArkAzureFunctionsAuthenticationOptions — removed the unimplemented ArkAzureFunctionsAuthenticationProfile enum and the Profile property. The class now only exposes Scheme.

Copilot AI requested a review from AndreaCuneo August 2, 2026 17:37
@AndreaCuneo
AndreaCuneo merged commit 4c78741 into master Aug 2, 2026
7 checks passed
@AndreaCuneo
AndreaCuneo deleted the copilot/azure-function-progress branch August 2, 2026 20:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
+1 more reviewer
@AndreaCuneo AndreaCuneo AndreaCuneo approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@AndreaCuneo AndreaCuneo

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@AndreaCuneo