Rinat Abdullin

This post does not belong to the primary body of knowledge within autofac or xLim series.

It expands on the last article about IoC scopes and application composition and attempts to provide quick proof of concept answer (POC) to one question from the DevExpress Forum on XAF about implementing security scenarios.

Let’s talk code:

public sealed class ContextSecurityController : ICommand
{
  private readonly GridParameters _parameters;
  private readonly IIdentityObject _parentObject;
  private readonly IGuidIdentity _user;

  public ContextSecurityController(GridParameters parameters,
    IIdentityObject parentObject, IGuidIdentity user)
  {
    _parameters = parameters;
    _user = user;
    _parentObject = parentObject;
  }

  public void Execute()
  {
    string s = _parameters.CriteriaString;
    if (!string.IsNullOrEmpty(s) && s.Contains("#{"))
    {
      _parameters.CriteriaString = s
        .Replace("#{AccountId}", _user.Id.ToString())
        .Replace("#{ActorId}", _user.Owner.ToString())
        .Replace("#{ParentObjectId}", _parentObject.Oid.ToString());
    }
  }
}

In this scenario this controller should be resolved in the view scope and executed once (yes, it has the ICommand interface, since it is just a command). Upon execution it attempts to parse the XPO criteria string and modify it a little bit.

Here are the steps to make this work within the current xLim concept:

• Add a comma-delimited list of start-up command names to the base ViewParameter object
• Add 3 lines of code to the base view object when it loads the parameters (string.Split(Current.StartupCommands) - foreach - ResolveByName - Execute)
• Configure the views to call this command/controller on startup.
• Make sure that the views, dealing with the data, pass the instance of the parent object to the scope
• Make sure that all the BOs inherit from IIdentityObject (I always do this, since this helps to provide ability to bind memos, documents, forms etc to any object in the system)

Then you could use criteria strings like:

• Document.CreatedByOid=#{AccountId}
• Employer.Manager.Oid=#{ParentObjectId}

Side effects:

• Any desktop or web view will get the ability to have configurable commands executed on the start-up (commands normally do not care about the UI)
• Since any application already has a huge list of commands in the library, you could re-use these, too.

This controller is extremely simple to extend with the support for more complex tokens (i.e.: #{DateTime}, #{CurrentOfficeId}, #{SecurityHash} etc), you just need to make sure that the values do not mess up the syntax of XPO. Or you could implement more complex parser that takes the named object from the current scope and evaluate some property of it. You’ll get the simplified scripting in that case.

One more option is to use the DSLs to express complex business requirements (although, I would not advise to do that).

PS: This approach seems to be simple and flexible, and yet it is not recommended for the xLim 2 implementations. Too much of flexibility in the wrong spot is not a good thing for the project in the long term (been there, done that). This post serves POC purpose only.