[Blazor] Propagate SignalR authentication refresh to server circuits

src/Components/Server/src/ComponentHub.cs

@@ -85,6 +85,14 @@ public override Task OnDisconnectedAsync(Exception exception)
         return _circuitRegistry.DisconnectAsync(circuitHost, Context.ConnectionId);
     }
 
+    public override Task OnAuthenticationRefreshedAsync()
+    {
+        var circuitHost = _circuitHandleRegistry.GetCircuit(Context.Items, CircuitKey);
+        circuitHost?.SetCircuitUser(Context.User);
+
+        return Task.CompletedTask;
+    }
+
     public async ValueTask<string> StartCircuit(string baseUri, string uri, string serializedComponentRecords, string applicationState)
     {
         var circuitHost = _circuitHandleRegistry.GetCircuit(Context.Items, CircuitKey);

src/Components/Server/test/Circuits/ComponentHubTest.cs

@@ -5,6 +5,7 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Security.Claims;
 using System.Text.RegularExpressions;
+using Microsoft.AspNetCore.Components.Authorization;
 using Microsoft.AspNetCore.Components.Server.Circuits;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Http;
@@ -334,11 +335,44 @@ public async Task ResumeCircuitFailsWithUnresolvedCircuitHandlerDependency_Notif
         mockClientProxy.Verify(m => m.SendCoreAsync("JS.Error", new[] { errorMessage }, It.IsAny<CancellationToken>()), Times.Once());
     }
 
+    [Fact]
+    public async Task OnAuthenticationRefreshedAsyncUpdatesCircuitUser()
+    {
+        var authenticationStateProvider = new ServerAuthenticationStateProvider();
+        var services = new ServiceCollection()
+            .AddSingleton<AuthenticationStateProvider>(authenticationStateProvider)
+            .BuildServiceProvider();
+        var circuitHost = TestCircuitHost.Create(serviceScope: services.CreateAsyncScope());
+
+        var handleRegistryMock = new Mock<ICircuitHandleRegistry>();
+        handleRegistryMock.Setup(m => m.GetCircuit(It.IsAny<IDictionary<object, object>>(), It.IsAny<object>()))
+            .Returns(circuitHost);
+
+        var refreshedUser = new ClaimsPrincipal(new ClaimsIdentity(
+            [new Claim(ClaimTypes.Name, "refreshed-user")],
+            "TestAuthType"));
+        var (_, hub) = InitializeComponentHub(handleRegistry: handleRegistryMock.Object, user: refreshedUser);
+
+        await hub.OnAuthenticationRefreshedAsync();
+
+        var authenticationState = await authenticationStateProvider.GetAuthenticationStateAsync();
+        Assert.Same(refreshedUser, authenticationState.User);
+    }
+
+    [Fact]
+    public async Task OnAuthenticationRefreshedAsyncWithoutCircuitDoesNotThrow()
+    {
+        var (_, hub) = InitializeComponentHub();
+
+        await hub.OnAuthenticationRefreshedAsync();
+    }
+
     private static (Mock<ISingleClientProxy>, ComponentHub) InitializeComponentHub(
         TestServerComponentDeserializer deserializer = null,
         ICircuitHandleRegistry handleRegistry = null,
         ICircuitPersistenceProvider provider = null,
-        ICircuitFactory circuitFactory = null)
+        ICircuitFactory circuitFactory = null,
+        ClaimsPrincipal user = null)
     {
         deserializer ??= new TestServerComponentDeserializer();
         var ephemeralDataProtectionProvider = new EphemeralDataProtectionProvider();
@@ -384,6 +418,7 @@ private static (Mock<ISingleClientProxy>, ComponentHub) InitializeComponentHub(
         feature.Set(httpContextFeature.Object);
         mockContext.Setup(x => x.Features).Returns(feature);
         mockContext.Setup(x => x.ConnectionId).Returns("123");
+        mockContext.Setup(x => x.User).Returns(user);
         hub.Context = mockContext.Object;
 
         return (mockClientProxy, hub);

src/Components/test/E2ETest/ServerExecutionTests/ServerAuthTest.cs

@@ -49,6 +49,29 @@ void AssertState(string username)
         }
     }
 
+    [Fact]
+    public void UpdatesAuthenticationStateWhenAuthenticationRefreshed()
+    {
+        SignInAs("Someone", "IrrelevantRole");
+        var appElement = MountAndNavigateToAuthTest(AuthorizeViewCases, "?captureAuthenticationRefresh");
+        Browser.Equal("You're not authorized, Someone", () =>
+            appElement.FindElement(By.CssSelector("#authorize-role .not-authorized")).Text);
+
+        var javascript = (IJavaScriptExecutor)Browser;
+        Assert.Equal(1L, javascript.ExecuteScript("return authenticationRefreshTest.negotiateCount;"));
+
+        SignInAs("Someone", "TestRole", useSeparateTab: true);
+        var refreshStatus = javascript.ExecuteAsyncScript("""
+            const callback = arguments[arguments.length - 1];
+            authenticationRefreshTest.refresh().then(callback);
+            """);
+
+        Assert.Equal(200L, refreshStatus);
+        Browser.Equal("Welcome, Someone!", () =>
+            appElement.FindElement(By.CssSelector("#authorize-role .authorized")).Text);
+        Assert.Equal(1L, javascript.ExecuteScript("return authenticationRefreshTest.negotiateCount;"));
+    }
+
     private void SignInAs(string usernName, string roles, bool useSeparateTab = false) =>
         Browser.SignInAs(new Uri(_serverFixture.RootUri, "/subdir"), usernName, roles, useSeparateTab);
 

src/Components/test/E2ETest/Tests/AuthTest.cs

@@ -225,9 +225,9 @@ private void AssertExpectedLayoutUsed()
         Browser.Exists(By.Id("auth-links"));
     }
 
-    protected IWebElement MountAndNavigateToAuthTest(string authLinkText)
+    protected IWebElement MountAndNavigateToAuthTest(string authLinkText, string queryString = "")
     {
-        Navigate(ServerPathBase);
+        Navigate($"{ServerPathBase}{queryString}");
         var appElement = Browser.MountTestComponent<BasicTestApp.AuthTest.AuthRouter>();
         Browser.Exists(By.Id("auth-links"));
         appElement.FindElement(By.LinkText(authLinkText)).Click();

src/Components/test/testassets/Components.TestServer/AuthenticationStartup.cs

@@ -61,7 +61,7 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
             {
                 endpoints.MapControllers();
                 endpoints.MapRazorPages();
-                endpoints.MapBlazorHub()
+                endpoints.MapBlazorHub(options => options.EnableAuthenticationRefresh = true)
                     .AddEndpointFilter(async (context, next) =>
                     {
                         if (context.HttpContext.WebSockets.IsWebSocketRequest)

src/Components/test/testassets/Components.TestServer/Pages/_ServerHost.cshtml

@@ -53,6 +53,26 @@
 
     <script src="_framework/blazor.server.js" autostart="false"></script>
     <script>
+        if (new URLSearchParams(location.search).has('captureAuthenticationRefresh')) {
+            const originalFetch = window.fetch;
+            window.authenticationRefreshTest = {
+                negotiateCount: 0,
+                async refresh() {
+                    const url = new URL('_blazor/refresh', document.baseURI);
+                    url.searchParams.set('id', this.connectionToken);
+                    return (await originalFetch(url, { method: 'POST' })).status;
+                },
+            };
+            window.fetch = async (input, init) => {
+                const response = await originalFetch(input, init);
+                if (`${input}`.includes('/negotiate')) {
+                    authenticationRefreshTest.negotiateCount++;
+                    authenticationRefreshTest.connectionToken = (await response.clone().json()).connectionToken;
+                }
+                return response;
+            };
+        }
+
         Blazor.start({
             reconnectionOptions: {
                 // It's easier to test the reconnection logic if we wait a bit