GraphQL!Policy.fs

type AllowedGroupRequierment (groups : string seq) =
    member val Groups = groups.ToImmutableHashSet ()
    interface IAuthorizationRequirement

type AllowedGroupHandler (graphService : IMicrosoftGraphService, userIdResult : Lazy<Result<GraphQLUser, Errors.ErrorMessage>>) =
    inherit AuthorizationHandler<AllowedGroupRequierment> ()
        override _.HandleRequirementAsync (context, requirement) = task {
            match userIdResult.Value with
            | Result.Error _ -> return () // user not authenticated / пользователь не аутентифицирован
            | Result.Ok user ->
            let! userGroups = graphService.AsyncGetUserGroupNames user.Id
            let requiredGroups = requirement.Groups
            let allowed = not <| requiredGroups.Intersect(userGroups).IsEmpty

            if allowed
            then context.Succeed requirement
            else ()
        }