Add custom policy provider example to authz BWA

[guardrex]

Addresses dotnet/AspNetCore.Docs#37370

Wade, these are the BWA authz sample updates for the custom authz policy provider doc overhaul, which is a WIP at dotnet/AspNetCore.Docs#37379. Let's merge this one first, and then the article PR should build without warnings.

[Copilot]

Pull request overview

Adds a custom IAuthorizationPolicyProvider example to the Blazor Web App authorization sample to demonstrate dynamically generated “MinimumAge*” policies (as requested in dotnet/AspNetCore.Docs#37370).

Changes:

• Register a custom authorization policy provider and add dynamic MinimumAge{N} policy support.
• Add two new pages demonstrating the dynamic policy via AuthorizeView and an attribute-based approach.
• Update the README’s seeded-user notes to include the new MinimumAge21 policy behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
security/authorization/BlazorWebAppAuthorization/README.md	Updates seeded account descriptions to reference MinimumAge21 in addition to AtLeast21.
security/authorization/BlazorWebAppAuthorization/Program.cs	Registers the custom IAuthorizationPolicyProvider.
security/authorization/BlazorWebAppAuthorization/Policies/Providers/MinimumAgePolicyProvider.cs	Adds a dynamic policy provider for MinimumAge{N} policies.
security/authorization/BlazorWebAppAuthorization/Policies/Attributes/MinimumAgeAuthorizeAttribute.cs	Adds a helper attribute for specifying MinimumAge{N} policies declaratively.
security/authorization/BlazorWebAppAuthorization/Components/Pages/PassMinimumAge21PolicyWithAttribute.razor	New page showing attribute-based authorization for MinimumAge21.
security/authorization/BlazorWebAppAuthorization/Components/Pages/PassMinimumAge21Policy.razor	New page showing AuthorizeView policy-based authorization for MinimumAge21.
security/authorization/BlazorWebAppAuthorization/Components/Pages/Home.razor	Adds navigation links to the new policy provider example pages.

Comments suppressed due to low confidence (3)

security/authorization/BlazorWebAppAuthorization/Policies/Providers/MinimumAgePolicyProvider.cs:23

• Returning null for unknown policies prevents policies defined via AddAuthorizationBuilder (for example, "AtLeast21") from being found once this provider is registered. Delegate to the fallback policy provider for non-MinimumAge* policies.

        return Task.FromResult<AuthorizationPolicy?>(null);

security/authorization/BlazorWebAppAuthorization/Policies/Providers/MinimumAgePolicyProvider.cs:30

• GetDefaultPolicyAsync should delegate to the fallback policy provider so the app’s configured DefaultPolicy (and any future changes to it) are honored, rather than hardcoding a new policy here.

    public Task<AuthorizationPolicy> GetDefaultPolicyAsync() =>
        Task.FromResult<AuthorizationPolicy>(
            new AuthorizationPolicyBuilder(
                IdentityConstants.ApplicationScheme)
            .RequireAuthenticatedUser().Build());

security/authorization/BlazorWebAppAuthorization/Policies/Providers/MinimumAgePolicyProvider.cs:33

• GetFallbackPolicyAsync should delegate to the fallback policy provider so any configured FallbackPolicy is honored (instead of always returning null).

    public Task<AuthorizationPolicy?> GetFallbackPolicyAsync() =>
        Task.FromResult<AuthorizationPolicy?>(null);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

security/authorization/BlazorWebAppAuthorization/Policies/Providers/MinimumAgePolicyProvider.cs:25

• Hard-coding IdentityConstants.ApplicationScheme here couples this dynamic policy to a specific authentication scheme. The rest of the sample’s policies rely on the app’s default authentication scheme, which is more flexible (and matches what readers typically want when reusing the pattern).

            var policy = new AuthorizationPolicyBuilder(
                IdentityConstants.ApplicationScheme);
            policy.AddRequirements(new MinimumAgeRequirement(age));

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

security/authorization/BlazorWebAppAuthorization/Components/Pages/Home.razor:87

• The link to the attribute-protected MinimumAge page is shown to any authenticated user, but Routes.razor renders a RedirectToLogin on any authorization failure. Users who don't satisfy MinimumAge21 (for example, seeded harry@contoso.com) will hit an auth-failure redirect loop when navigating to this page. Consider only showing this nav item to users who satisfy the policy (or otherwise avoid sending unauthorized users to an [Authorize]-protected route in this sample).

        <div class="nav-item px-3">
            <NavLink class="nav-link" href="pass-minimumage21-policy-with-attribute">
                <span class="bi bi-person-fill-nav-menu" aria-hidden="true"></span> Pass 'MinimumAge21' Policy (attribute-based)
            </NavLink>
        </div>

[wadepickett]

@guardrex, approved. See minor suggestions.

[guardrex]

Feedback addressed.

I was hoping to have the main article PR ready today, but it's getting late with an unrelated task to finish. It's looking more like the main article PR will be ready for review tomorrow (Thursday).