RequiresAuthenticationConvention.cs

public class RequiresAuthenticationConvention : IConfigurationAction
{
	public void Configure(BehaviorGraph graph)
	{
		graph
			.Actions()
			.Where(action => action.HasInput && !action.InputType().HasAttribute<AllowUnauthenticatedAccessAttribute>())
			.Each(call =>
				  {
					var log = graph.Observer;
					if (log.IsRecording)
					{
						log.RecordCallStatus(call, "{0} has an input model that requires authentication.".ToFormat(call));
					}
					var modelType = call.InputType();
					var policyType = typeof (AuthorizationPolicy<>).MakeGenericType(modelType);
					var ruleType = typeof (RequiresAuthenticationRule<>).MakeGenericType(modelType);

					var policyDef = call
						.ParentChain()
						.Authorization
						.AddPolicy(policyType);

					var ruleObjectDef = new ObjectDef(ruleType);
					policyDef.Dependencies.Add(new ConfiguredDependency()
											   {
												DependencyType = typeof(IAuthorizationRule<>).MakeGenericType(modelType),
												Definition = ruleObjectDef
											   });
				  });
	}
}