Repository: dotnet/aspnetcore
File: src/Security/Authorization/Core/src/AuthorizationServiceExtensions.cs (C#)

Code before:
    /// <param name="service">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="user">The user to evaluate the policy against.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="requirement">The requirement to evaluate the policy against.</param>
    /// <returns>
    /// A <see cref="Task{TResult}"/> that contains an <see cref="AuthorizationResult"/> indicating whether requirement evaluation has succeeded or failed.
    /// The result's <see cref="AuthorizationResult.Succeeded"/> property is <c>true</c> when the user fulfills the policy, otherwise <c>false</c>.
    /// </returns>
    public static Task<AuthorizationResult> AuthorizeAsync(this IAuthorizationService service, ClaimsPrincipal user, object? resource, IAuthorizationRequirement requirement)
    {
        ArgumentNullThrowHelper.ThrowIfNull(service);
        ArgumentNullThrowHelper.ThrowIfNull(requirement);

        return service.AuthorizeAsync(user, resource, new IAuthorizationRequirement[] { requirement });
    }

    /// <summary>
    /// Checks if a user meets a specific authorization policy against the specified resource.
    /// </summary>
    /// <param name="service">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="user">The user to evaluate the policy against.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="policy">The policy to evaluate.</param>
    /// <returns>
    /// A <see cref="Task{TResult}"/> that contains an <see cref="AuthorizationResult"/> indicating whether policy evaluation has succeeded or failed.
    /// The result's <see cref="AuthorizationResult.Succeeded"/> property is <c>true</c> when the user fulfills the policy, otherwise <c>false</c>.
    /// </returns>
    public static Task<AuthorizationResult> AuthorizeAsync(this IAuthorizationService service, ClaimsPrincipal user, object? resource, AuthorizationPolicy policy)
    {
        ArgumentNullThrowHelper.ThrowIfNull(service);
        ArgumentNullThrowHelper.ThrowIfNull(policy);

        return service.AuthorizeAsync(user, resource, policy.Requirements);
    }

    /// <summary>
    /// Checks if a user meets a specific authorization policy against the specified resource.
    /// </summary>
    /// <param name="service">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="user">The user to evaluate the policy against.</param>
    /// <param name="policy">The policy to evaluate.</param>
    /// <returns>
    /// A <see cref="Task{TResult}"/> that contains an <see cref="AuthorizationResult"/> indicating whether policy evaluation has succeeded or failed.
    /// The result's <see cref="AuthorizationResult.Succeeded"/> property is <c>true</c> when the user fulfills the policy, otherwise <c>false</c>.
    /// </returns>
    public static Task<AuthorizationResult> AuthorizeAsync(this IAuthorizationService service, ClaimsPrincipal user, AuthorizationPolicy policy)
    {
        ArgumentNullThrowHelper.ThrowIfNull(service);
        ArgumentNullThrowHelper.ThrowIfNull(policy);

        return service.AuthorizeAsync(user, resource: null, policy: policy);

Review comment (security):
```suggestion
    /// The result's <see cref="AuthorizationResult.Succeeded"/> property is <c>true</c> when the user fulfills the policy; otherwise <c>false</c>.
```

Code after:
    /// <param name="service">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="user">The user to evaluate the policy against.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="requirement">The requirement to evaluate the policy against.</param>
    /// <returns>
    /// A <see cref="Task{TResult}"/> that contains an <see cref="AuthorizationResult"/> indicating whether requirement evaluation has succeeded or failed.
    /// The result's <see cref="AuthorizationResult.Succeeded"/> property is <c>true</c> when the user fulfills the policy; otherwise <c>false</c>.
    /// </returns>
    public static Task<AuthorizationResult> AuthorizeAsync(this IAuthorizationService service, ClaimsPrincipal user, object? resource, IAuthorizationRequirement requirement)
    {
        ArgumentNullThrowHelper.ThrowIfNull(service);
        ArgumentNullThrowHelper.ThrowIfNull(requirement);

        return service.AuthorizeAsync(user, resource, new IAuthorizationRequirement[] { requirement });
    }

    /// <summary>
    /// Checks if a user meets a specific authorization policy against the specified resource.
    /// </summary>
    /// <param name="service">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="user">The user to evaluate the policy against.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="policy">The policy to evaluate.</param>
    /// <returns>
    /// A <see cref="Task{TResult}"/> that contains an <see cref="AuthorizationResult"/> indicating whether policy evaluation has succeeded or failed.
    /// The result's <see cref="AuthorizationResult.Succeeded"/> property is <c>true</c> when the user fulfills the policy; otherwise <c>false</c>.
    /// </returns>
    public static Task<AuthorizationResult> AuthorizeAsync(this IAuthorizationService service, ClaimsPrincipal user, object? resource, AuthorizationPolicy policy)
    {
        ArgumentNullThrowHelper.ThrowIfNull(service);
        ArgumentNullThrowHelper.ThrowIfNull(policy);

        return service.AuthorizeAsync(user, resource, policy.Requirements);
    }

    /// <summary>
    /// Checks if a user meets a specific authorization policy against the specified resource.
    /// </summary>
    /// <param name="service">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="user">The user to evaluate the policy against.</param>
    /// <param name="policy">The policy to evaluate.</param>
    /// <returns>
    /// A <see cref="Task{TResult}"/> that contains an <see cref="AuthorizationResult"/> indicating whether policy evaluation has succeeded or failed.
    /// The result's <see cref="AuthorizationResult.Succeeded"/> property is <c>true</c> when the user fulfills the policy; otherwise <c>false</c>.
    /// </returns>
    public static Task<AuthorizationResult> AuthorizeAsync(this IAuthorizationService service, ClaimsPrincipal user, AuthorizationPolicy policy)
    {
        ArgumentNullThrowHelper.ThrowIfNull(service);
        ArgumentNullThrowHelper.ThrowIfNull(policy);

        return service.AuthorizeAsync(user, resource: null, policy: policy);