Flow endpoint and httpcontext always from authz middleware

[HaoK]

Fixes: #16695

[pranavkm]

Could we make an announcement for this?

[HaoK]

Yep I'll open an announcement

[HaoK]

Breaking change issue dotnet/docs#19034

[davidfowl]

This is a runtime breaking change so it’s a big deal. People will migrate to 5.0 and nothing will tell them this is broken after migration until you happen to read the docs. I suggest we do more and write an analyzer to detect consumption of this object at runtime.

cc @pranavkm

[davidfowl]

cc @Pilchie @DamianEdwards @LadyNaggaga

[HaoK]

We could also just do this in a non breaking way and add an AuthorizationMiddlewareOptions.UseHttpContextAsResource = false and only do this if they set it to true

[pranavkm]

One of the options we briefly discussed during 3.0 was wrapping the context in an object that allows casting to HttpContext or Endpoint. If your previous code looked like var endpoint = (Endpoint)resource, we could make that work. It does not work with pattern matching expressions. Perhaps we could do that in addition to adding a UseHttpContextAsResource option that is on by default. Unlike Startup code, handler code might exist in libraries which an analyzer wouldn't be useful in.

[HaoK]

Is the worry that there will be code outside of the app in a library that wouldn't be able to react to this mode? Would that be like some other kind of identity UI packages like thing which might have baked in code expecting the endpoint?