That is true, and is a possibility of which I'm aware. I don't directly consider it a bug however, for two reasons.
First, this enables a scenario where you have a "security loader" object that loads all the per-type rules for your business layer all at once (probably data driven). That's very valuable.
Second, it is not clear how I'd prevent this in any case. At least not without seriously complicating the process of calling AllowEdit(), etc. The only real solution would involve making those methods internal to CSLA, and then having all the CSLA base classes expose a protected instance of some class that could invoke the internal methods. Very messy - and this would preclude the security loader concept.
RockfordLhotka:
That is true, and is a possibility of which I'm aware. I don't directly consider it a bug however, for two reasons.
that's true if you are aware of it it's not really a bug :)
First, this enables a scenario where you have a "security loader" object that loads all the per-type rules for your business layer all at once (probably data driven). That's very valuable.Second, it is not clear how I'd prevent this in any case. At least not without seriously complicating the process of calling AllowEdit(), etc. The only real solution would involve making those methods internal to CSLA, and then having all the CSLA base classes expose a protected instance of some class that could invoke the internal methods. Very messy - and this would preclude the security loader concept.
Good point.
One solution might be to make a private property bool _permissionsSealed.
After setting permissionsSealed = true a call to this would throw an exception:
Csla.Security.AuthorizationRules.AllowEdit(typeof(Library.Edges.EdgeBase), new string[] { "Me", "Myself", "I", "Artist" });
throws excpetion
Business base could automatically set permissionsSealed after calling AddObjectAuthorizationRules()
So a user loading business rules from the outside would just need to make sure to do it in the very beginning before AddObjectAuthorizationRules() is called.
All the best,
Patrick
Copyright (c) Marimer LLC