How do you implement authorization for a list of resources?
All docs I see are based on IAuthorizationService and the AuthorizeAsync methods. But this, only applies to one resource.
Should I be retrieving all resources and then imperatively check if the user has access or not using the AuthorizeAsync method of the IAuthorizationService? This seems very ackward, slow and inneficient.
How would you do this?
I have implemented this in few of my projects and aside from fetching all resources from the database and then executing AuthorizeAsync on each of them there is not much that you can do (so far as I know).
In some cases you can have mapping table in the database that stores resourceId/userId and check according to that. It is easier to fetch items that way without executing AuthorizeAsync on each, but it is not applicable in each scenario...
There are a few questions on this subject (such as https://github.com/dotnet/AspNetCore.Docs/issues/10244) but no solution.
