Request ifAuthenticatedInRole error

[aghoughton]

Apologies if I'm missing something, am trying out the framework for the first time and running into an authentication issue.

Relevant points:

• Using .net10
• Entity Framework / Postgres
• ASP.NET Identity framework for authorization / authentication

Everything appears to work fine until I try to request authentication for an endpoint when not logged in.

Endpoint handler:

let Test : HttpHandler =
    let scheme = IdentityConstants.ApplicationScheme
    let handleAuthInRole : HttpHandler = fun ctx ->
        Response.ofPlainText "Authorised" ctx
    let rolesAllowed = ["Admin"]
    Request.ifAuthenticatedInRole scheme rolesAllowed handleAuthInRole

However when it calls the 'ifAuthenticatedInRole' method I get a NullReferenceException

Request.fs

let ifAuthenticatedInRole
    (authScheme : string)
    (roles : string list)
    (handleOk : HttpHandler) : HttpHandler =
    authenticate authScheme (fun authenticateResult ctx ->
        let isInRole = List.exists authenticateResult.Principal.IsInRole roles
        match authenticateResult.Succeeded, isInRole with
        | true, true ->
            handleOk ctx
        | _ ->
            ctx.ForbidAsync())

When the match is performed authenticateResult has a Succeeded value of false (as expected because I'm not logged in) but the isInRole function is still called. Given the authentication did not succeed the authenticateResult.Principal is null hence causing an error.

It seems the ifAuthenticatedWithScope function verifies whether the authenticationResult has succeeded before trying to access the authenticateResult.Principal. I'm wondering whether ifAuthenticatedInRole should be doing the same thing.

Suggested change to ifAuthenticatedInRole:

let ifAuthenticatedInRole
    (authScheme : string)
    (roles : string list)
    (handleOk : HttpHandler) : HttpHandler =
    authenticate authScheme (fun authenticateResult ctx ->
        let isInRole = List.exists authenticateResult.Principal.IsInRole roles
        if authenticateResult.Succeeded && isInRole then
            handleOk ctx
        else
            ctx.ForbidAsync())

Hopefully I'm not missing something obvious