locked
How do I filter records based on the users role. RRS feed

  • Question

  • In my sales order entity, I want to filter records based on two criteria: (1) the user's role (2) the users store 

    if the user role is administrator = return all sales orders.
    if the user role is sales = return all sales orders where salesorders.store = employee.store.

    I'm not sure how to get the role(s) of the current user.  

    This is what I have so far, please feel free point me another direction if this isn't the best way to do this. I"m still learning. 

    partial void SalesOrders_All_PreprocessQuery(ref IQueryable<SalesOrder> query)
            {
                //get the current user
                var currentUser = this.Application.User.Name;
    
                //get the userEmployee record of the current user
                var useremployee = (from employees in this.DataWorkspace.ShowroomData.aspnet_UsersToEmployees
                                    where employees.aspnet_User.UserName == currentUser
                                    select employees).FirstOrDefault();
                

     

                //get the roles of the current user
                
               ***Not sure what to do here:
    var aspnetUser = (from users in this.DataWorkspace.SecurityData.????

     

                
                //filter the query based on the role
    
    ***not really sure what to do here either****
    if the role is administrator = return all records
    if the role is sales = return records where salesorders.storeId = useremployee.storeId
    }

    Please excuse my pseudo code, but I"m having to work through in my head the process to follow to get this done.

    Also, I was looking around msdn, does lightswitch not have a class or type references like all of the other .net stuff? Where do I go to find an explanation of all the members in the lightswitch namespace? I think I need more eplanation of each method, etc.. and what it does.




    • Edited by Missiodei Thursday, January 5, 2012 6:33 PM
    Thursday, January 5, 2012 6:26 PM

Answers

  • You are very close to it, but you should not use roles, but Permissions.

    A permission is a kind of security indirection that many application frameworks use. A permission is a security dependency more closely related to a particular functionaly whereas a role is just a collection of permissions.

    In lightswitch, the set of permissions that make up a role can be configured in the databases, so they are not "hard-coded" in the application.

    When you go to the property window of the lightswitch project, you can define the permissions in the access control tab.

    The following code can check if a user has a certain permission:

    this.Application.User.HasPermission(Permissions.<mypermission>)


    paul van bladel
    Thursday, January 5, 2012 9:53 PM

All replies

  • You are very close to it, but you should not use roles, but Permissions.

    A permission is a kind of security indirection that many application frameworks use. A permission is a security dependency more closely related to a particular functionaly whereas a role is just a collection of permissions.

    In lightswitch, the set of permissions that make up a role can be configured in the databases, so they are not "hard-coded" in the application.

    When you go to the property window of the lightswitch project, you can define the permissions in the access control tab.

    The following code can check if a user has a certain permission:

    this.Application.User.HasPermission(Permissions.<mypermission>)


    paul van bladel
    Thursday, January 5, 2012 9:53 PM
  • I have my permissions set as:

    canread

    candedit

    caninsert

    candelete

    How would I handle it if the everyone can read, however everyone can only read from the records where salesorder.store is equal to your useremployee.store ?

    Thursday, January 5, 2012 10:05 PM
  • What would be wrong with this?

    if (this.Application.User.IsInRole("Admin"))
    	        {
    		        query = (from so in query
                             orderby so.Customer
                             select so);
    	        }
               else if (this.Application.User.IsInRole("Sales"));
               {
                    query = (from so in query
                            where so.StoreCode == employeestore
                            select so);
               }

    Thursday, January 5, 2012 10:06 PM
  • The problem is that at design time, you (as the developer) do not know what roles will be set up by the application administrator (a user). The only thing you definitely know about are what permissions are available (because you defined them).
    Justin Anderson, LightSwitch Development Team
    Thursday, January 5, 2012 10:19 PM
    Moderator
  • so basically just create a IsSales Permission and if the user as this permission then filter the query the way I want?
    Thursday, January 5, 2012 10:25 PM
  • Yes, that's correct. then it's up to the administrative user to assign that permission to roles, & to assign roles to users.

    To you it shouldn't matter which role has the permission, or how the user ended up with the permission, just that they have the permission "somehow".


    Yann - LightSwitch Central - Click here for FREE Themes, Controls, Types and Commands
     
    If you find a reply helpful, please click "Vote as Helpful", if a reply answers your question, please click "Mark as Answer"
     
    By doing this you'll help people find answers faster.
    Friday, January 6, 2012 4:27 AM
    Moderator
  • Indeed, the permission mechanism is superior.

    The only "conceptual" problem I have is that there is a difference between

    a) the permissions of the type _CanDo (as used client side for button clicks and server side for myentity_canInsert) and

    b) the permission described above, which has more to do with row-level security. (A permission defines a kind of additional filter on the returned set of rows a user can see)

    For me a permission, is a kind of privilege I have in the application. The more permissions I have, the more I can do and see. When I have all permissions checked, I'm probably the application admin.

    Ok, that's clear for everyone and this is perfectly ok for permissions of the type _CanDo, but it conflicts a bit with the row-level security permissions. "Checking" a row-level security permissions, means less rights (because an aditional filter is applied).

    Do you see an elegant way how to handle this?

     


    paul van bladel
    Friday, January 6, 2012 7:41 AM
  • I have my permissions set as:

    canread

    candedit

    caninsert

    candelete

    How would I handle it if the everyone can read, however everyone can only read from the records where salesorder.store is equal to your useremployee.store ?

    These methods are not meant for row-level security, you can only use them on "entity level". So, you say "brute-force": someone without permission x can not insert e.g. customers. The nice thing is that this knowledge becomes part of the "domain model", which means that the knowledge is also available client side, and LightSwitch will reorganize accordingly the different buttons (e.g. for inserting, editing, deleting customers) and the read-only state of the screen controls .

    You can see clearly that they are not meant for row-level security,  by examining the method signature of these guys, the have no reference to the "current row", the can only update a result Boolean param where you say "brute force", ok you can do it, or you can't.

    So, if you have a more fine-grained "canread" rule other than just "you can read - can't see any record", you should use the preprocessquery method for applying the more fine-grained filtering as described in this forum post.


    paul van bladel
    Friday, January 6, 2012 7:53 AM