[Blazor] AuthorizeViewCore should expose AuthorizationResult to NotAuthorized template

[javiercn]

AuthorizeViewCore currently only exposes an AuthenticationState context to the NotAuthorized render fragment. It does not provide access to the full AuthorizationResult, including AuthorizationFailureReason messages set by custom authorization handlers.

Problem

When implementing custom authorization handlers that use context.Fail(new AuthorizationFailureReason(...)) to provide detailed failure messages, there is no supported way to surface these messages in the NotAuthorized render fragment.

The current implementation in AuthorizeViewCore.IsAuthorizedAsync() discards the full authorization result:

var result = await AuthorizationService.AuthorizeAsync(user, Resource, policy!);
return result.Succeeded; // Only boolean is returned, AuthorizationResult is lost

Proposed Solution

Introduce a new Forbidden render fragment that handles the "authenticated but not authorized" (403) case separately from NotAuthorized. This new fragment would have a context type that includes AuthorizationResult and failure reasons, enabling developers to display detailed error messages. This approach mirrors HTTP semantics (401 vs 403) and keeps NotAuthorized backward-compatible.

Alternatives Considered

• Add a new property to expose AuthorizationResult - Not ideal as it can't be easily consumed within the render fragment context.
• Introduce a new context type extending AuthenticationState - Same usability concerns; doesn't integrate naturally with the existing templating model.
• Use a cascading parameter - Requires creating an additional wrapper component to consume the result, adding unnecessary complexity.

Desired Behavior

Allow developers to display custom error messages (e.g., "Missing permission: project.read") instead of generic "Access Denied" text when authorization fails.

Related

Extracted from: #65007

[MihuBot]

I'm a bot. Here is a possible related and/or duplicate issue (I may be wrong):

• AuthorizeView should expose the results of the AuthorizeAsync call as a context variable. #43959