Fix ApplyPolicy.Validation not enforced on code-first fields

src/HotChocolate/Core/src/Authorization/Extensions/AuthorizeObjectFieldDescriptorExtensions.cs

@@ -26,7 +26,7 @@ public static IObjectFieldDescriptor Authorize(
 
         if (apply is ApplyPolicy.Validation)
         {
-            descriptor.ModifyAuthorizationFieldOptions(o => o with { AuthorizeAtRequestLevel = true });
+            descriptor.Extend().Context.ModifyAuthorizationFieldOptions(o => o with { AuthorizeAtRequestLevel = true });
         }
 
         return descriptor.Directive(new AuthorizeDirective(apply: apply));
@@ -53,7 +53,7 @@ public static IObjectFieldDescriptor Authorize(
 
         if (apply is ApplyPolicy.Validation)
         {
-            descriptor.ModifyAuthorizationFieldOptions(o => o with { AuthorizeAtRequestLevel = true });
+            descriptor.Extend().Context.ModifyAuthorizationFieldOptions(o => o with { AuthorizeAtRequestLevel = true });
         }
 
         return descriptor.Directive(new AuthorizeDirective(policy, apply: apply));

src/HotChocolate/Core/test/Authorization.Tests/CodeFirstAuthorizationTests.cs

@@ -253,6 +253,54 @@ public async Task Authorize_Field_Auth_Not_Allowed_On_Validation()
         Assert.Equal(401, value);
     }
 
+    [Fact]
+    public async Task Authorize_Field_Validation_NoAccess_When_Type_Not_Authorized()
+    {
+        // arrange
+        // only the field carries a validation policy; the query type itself is not authorized,
+        // so request-level enforcement must be triggered by the field configuration alone.
+        var handler = new AuthHandler(
+            resolver: (_, _) => AuthorizeResult.Allowed,
+            validation: (_, _) => AuthorizeResult.NotAllowed);
+
+        var executor =
+            await new ServiceCollection()
+                .AddGraphQLServer()
+                .AddQueryType(d => d
+                    .Name("Query")
+                    .Field("sensitiveData")
+                    .Type<StringType>()
+                    .Resolve("sensitive data")
+                    .Authorize("READ_AUTH", ApplyPolicy.Validation))
+                .AddAuthorizationHandler(_ => handler)
+                .BuildRequestExecutorAsync();
+
+        // act
+        var result = await executor.ExecuteAsync("{ sensitiveData }");
+
+        // assert
+        Snapshot
+            .Create()
+            .Add(result)
+            .MatchInline(
+                """
+                {
+                  "errors": [
+                    {
+                      "message": "The current user is not authorized to access this resource.",
+                      "extensions": {
+                        "code": "AUTH_NOT_AUTHORIZED"
+                      }
+                    }
+                  ]
+                }
+                """);
+
+        Assert.NotNull(result.ContextData);
+        Assert.True(result.ContextData.TryGetValue(ExecutionContextData.HttpStatusCode, out var value));
+        Assert.Equal(401, value);
+    }
+
     [Fact]
     public async Task Authorize_Schema_Field()
     {