How do you use AllowExecute/DenyExecute?

How do you use AllowExecute/DenyExecute?

Old forum URL: forums.lhotka.net/forums/t/4349.aspx

boo posted on Thursday, February 14, 2008

I'm trying to ensure only authorized roles can delete a 'User' (editable root).  In the override or AddAuthorization rules I have the following (I assume ? is for anoymous and * is for everyone).

 

AuthorizationRules.AllowExecute("Delete", "AllowDeleteUser");

AuthorizationRules.AllowExecute("DeleteUser", "AllowDeleteUser");

AuthorizationRules.DenyExecute("Delete", "*");

AuthorizationRules.DenyExecute("DeleteUser", "*");

 

However when calling

User.Delete();

User.Save();

or

User.DeleteUser(id);

 

Using someone who isn't in these roles I don't get an error?  Do I have to call something in each DataPortal_XYZ method to check roles?  What's the point then in even putting anything in the AddAuthorizationRules method; I figured this would all work automatically the way business rules checks work.

 

Also in ListBase is there a AllowAddItem, AllowDeleteItem method?  I want to prevent users not in the right role from adding or removing child object items.  They are allowed to edit the parent, and edit the children, but they can't add new items or remove current items...that's a different role.

 

Thanks

ajj3085 replied on Thursday, February 14, 2008

Those methods are normally for allowing / denying access to your own custom methods on an object.  For example, I have a method called Lock on my Invoice object that locks the invoice. 

In your case, the normal pattern is to check your CanDeleteObject() static method in an override of Save and thrown an exception if the access method returns false.  Check out the PTracker sample.

It does raise an intereting point though.. maybe Rocky should add a CanExecuteMethod check to the Delete method.  That way it functions more closely to a method you'd write, and a user couldn't put the object into the deleted state if they didn't have permission.

boo replied on Thursday, February 14, 2008

Thanks.  I had a feeling that might be the answer but I was hoping I was wrong because I've come to expect that the CSLA will encapsulate all of this for me; the way business rules does.

Copyright (c) Marimer LLC