DevExpress_XPO_自定义安全对象（用户、角色、操作权限）

我们将学习如何创建自定义安全对象（包括角色、用户和权限）。

注：这个例子只适用于XPO应用程序。（要在EF应用程序中使用），请自行修改。

完整项目演示网址请参考官网。

实现自定义的角色和用户对象

•  角色继承PermissionPolicyRole类，使用附加属性CanExport。

using DevExpress.Persistent.BaseImpl.PermissionPolicy;
// ... 
[DefaultClassOptions, ImageName("BO_Role")]
public class ExtendedSecurityRole : PermissionPolicyRole {
    public ExtendedSecurityRole(Session session) : base(session) { }
    public bool CanExport {
        get { return GetPropertyValue<bool>("CanExport"); }
        set { SetPropertyValue<bool>("CanExport", value); }
    }
}

•   按照如下方式布局页面。
• 下面代码演示了自定义用户对象的实现。

using DevExpress.Persistent.BaseImpl.PermissionPolicy;
// ... 
[DefaultClassOptions, ImageName("BO_Employee")]
public class Employee : PermissionPolicyUser {
    public Employee(Session session)
        : base(session) { }
    [Association("Employee-Task")]
    public XPCollection<Task> Tasks {
        get { return GetCollection<Task>("Tasks");  }
    }
}
[DefaultClassOptions, ImageName("BO_Task")]
public class Task : BaseObject {
    public Task(Session session)
        : base(session) { }
    private string subject;
    public string Subject {
        get { return subject; }
        set { SetPropertyValue("Subject", ref subject, value); }
    }
    private DateTime dueDate;
    public DateTime DueDate {
        get { return dueDate; }
        set { SetPropertyValue("DueDate", ref dueDate, value); }
    }
    private Employee assignedTo;
    [Association("Employee-Task")]
    public Employee AssignedTo {
        get { return assignedTo; }
        set { SetPropertyValue("AssignedTo", ref assignedTo, value); }
    }
}

•  调用应用程序设计器，并按照下图所示拖拽主键。修改AuthenticationStandard的RoleType和UserType。

 实现自定义操作权限和权限请求

• 继承接口IOperationPermission。

using DevExpress.ExpressApp.Security;
// ... 
public class ExportPermission : IOperationPermission {
    public string Operation { 
        get { return "Export"; }
    }
}

•  要实现添加权限请求，需要实现IPermissionRequest接口。

public class ExportPermissionRequest : IPermissionRequest {
    public object GetHashObject() {
        return this.GetType().FullName;
    }
}

在安全策略中实现权限请求处理器

• 所有权限请求都应该在安全策略中注册适当的权限请求处理器。继承PermissionRequestProcessorBase类，并将权限请求类型作为祖先类的泛型参数传递，以实现一个类作为处理器。

public class ExportPermissionRequestProcessor : 
    PermissionRequestProcessorBase<ExportPermissionRequest> {
    private IPermissionDictionary permissions;
    public ExportPermissionRequestProcessor(IPermissionDictionary permissions) {
        this.permissions = permissions;
    }
    public override bool IsGranted(ExportPermissionRequest permissionRequest) {
        return (permissions.FindFirst<ExportPermission>() != null);
    }
}

•  在事件处理程序中，将ExportPermission对象传递给PermissionDictionary。

Win版本（Global.asax.cs (Global.asax.vb)）

((SecurityStrategy)winApplication.Security).CustomizeRequestProcessors +=
    delegate(object sender, CustomizeRequestProcessorsEventArgs e) {
        List<IOperationPermission> result = new List<IOperationPermission>();
        SecurityStrategyComplex security = sender as SecurityStrategyComplex;
        if (security != null) {
            Employee user = security.User as Employee;
            if (user != null) {
                foreach (ExtendedSecurityRole role in user.Roles) {
                    if (role.CanExport) {
                        result.Add(new ExportPermission());
                    }
                }
            }
        }
        IPermissionDictionary permissionDictionary = new PermissionDictionary((IEnumerable<IOperationPermission>)result);
        e.Processors.Add(typeof(ExportPermissionRequest), new ExportPermissionRequestProcessor(permissionDictionary));
    }; 
winApplication.Setup();
winApplication.Start();

 　　　　ASP.NET版本（Program.cs (Program.vb)）

((SecurityStrategy)WebApplication.Instance.Security).CustomizeRequestProcessors +=
    delegate(object s, CustomizeRequestProcessorsEventArgs args) {
        List<IOperationPermission> result = new List<IOperationPermission>();
        SecurityStrategyComplex security = s as SecurityStrategyComplex;
        if (security != null) {
            Employee user = security.User as Employee;
            if (user != null) {
                foreach (ExtendedSecurityRole role in user.Roles) {
                    if (role.CanExport) {
                        result.Add(new ExportPermission());
                    }
                }
            }
        }
        IPermissionDictionary permissionDictionary = new PermissionDictionary((IEnumerable<IOperationPermission>)result);
        args.Processors.Add(typeof(ExportPermissionRequest), new ExportPermissionRequestProcessor(permissionDictionary));
    };
WebApplication.Instance.Setup();
WebApplication.Instance.Start();

 Application Server

static void Main(string[] args) {
    // ... 
    Func<IDataServerSecurity> dataServerSecurityProvider = () => {
        SecurityStrategyComplex security = new SecurityStrategyComplex(
            typeof(Employee), typeof(ExtendedSecurityRole), new AuthenticationStandard());
        security.CustomizeRequestProcessors +=
            delegate(object sender, CustomizeRequestProcessorsEventArgs e) {
                List<IOperationPermission> result = new List<IOperationPermission>();
                if (security != null) {
                    Employee user = security.User as Employee;
                    if (user != null) {
                        foreach (ExtendedSecurityRole role in user.Roles) {
                            if (role.CanExport) {
                                result.Add(new ExportPermission());
                            }
                        }
                    }
                }
                IPermissionDictionary permissionDictionary = new PermissionDictionary((IEnumerable<IOperationPermission>)result);
                e.Processors.Add(typeof(ExportPermissionRequest), new ExportPermissionRequestProcessor(permissionDictionary));
            }; 
        return security;
    };
    // ... 
}

初始化方法说明

WcfDataServerHelper.AddKnownType(typeof(ExportPermissionRequest));

在ExportController控制器中考虑自定义权限

自定义中，代码如下（不允许导出数据的用户禁用控制器）：

public class SecuredExportController : ViewController {
    protected override void OnActivated() {
        base.OnActivated();
        ExportController controller = Frame.GetController<ExportController>();
        if (controller != null) {
            controller.ExportAction.Executing += ExportAction_Executing;
            if(SecuritySystem.Instance is IRequestSecurity) {
                controller.Active.SetItemValue("Security", 
                    SecuritySystem.IsGranted(new ExportPermissionRequest()));
            }
        }
    }
    void ExportAction_Executing(object sender, System.ComponentModel.CancelEventArgs e) {
        SecuritySystem.Demand(new ExportPermissionRequest());
    }
}

 添加演示数据

public class Updater : ModuleUpdater {
    public Updater(IObjectSpace objectSpace, Version currentDBVersion) : 
        base(objectSpace, currentDBVersion) { }
    public override void UpdateDatabaseAfterUpdateSchema() {
        base.UpdateDatabaseAfterUpdateSchema();
        ExtendedSecurityRole defaultRole = CreateUserRole();
        ExtendedSecurityRole administratorRole = CreateAdministratorRole();
        ExtendedSecurityRole exporterRole = CreateExporterRole();
        Employee userAdmin = ObjectSpace.FindObject<Employee>(new BinaryOperator("UserName", "Admin"));
        if (userAdmin == null) {
            userAdmin = ObjectSpace.CreateObject<Employee>();
            userAdmin.UserName = "Admin";
            userAdmin.IsActive = true;
            userAdmin.SetPassword("");
            userAdmin.Roles.Add(administratorRole);
        }
        Employee userSam = ObjectSpace.FindObject<Employee>(new BinaryOperator("UserName", "Sam"));
        if (userSam == null) {
            userSam = ObjectSpace.CreateObject<Employee>();
            userSam.UserName = "Sam";
            userSam.IsActive = true;
            userSam.SetPassword("");
            userSam.Roles.Add(exporterRole);
            userSam.Roles.Add(defaultRole);
        }
        Employee userJohn = ObjectSpace.FindObject<Employee>(new BinaryOperator("UserName", "John"));
        if (userJohn == null) {
            userJohn = ObjectSpace.CreateObject<Employee>();
            userJohn.UserName = "John";
            userJohn.IsActive = true;
            userJohn.Roles.Add(defaultRole);
            for (int i = 1; i <= 10; i++) {
                string subject = string.Format("Task {0}",i);
                Task task = ObjectSpace.FindObject<Task>(new BinaryOperator("Subject", subject));
                if (task == null) {
                    task = ObjectSpace.CreateObject<Task>();
                    task.Subject = subject;
                    task.DueDate = DateTime.Today;
                    task.Save();
                    userJohn.Tasks.Add(task);
                }
            }
        }
        ObjectSpace.CommitChanges();
    }
    private ExtendedSecurityRole CreateAdministratorRole() {
        ExtendedSecurityRole administratorRole = ObjectSpace.FindObject<ExtendedSecurityRole>(
            new BinaryOperator("Name", SecurityStrategyComplex.AdministratorRoleName));
        if (administratorRole == null) {
            administratorRole = ObjectSpace.CreateObject<ExtendedSecurityRole>();
            administratorRole.Name = SecurityStrategyComplex.AdministratorRoleName;
            administratorRole.IsAdministrative = true;
        }
        return administratorRole;
    }
    private ExtendedSecurityRole CreateExporterRole() {
        ExtendedSecurityRole exporterRole = ObjectSpace.FindObject<ExtendedSecurityRole>(
            new BinaryOperator("Name", "Exporter"));
        if (exporterRole == null) {
            exporterRole = ObjectSpace.CreateObject<ExtendedSecurityRole>();
            exporterRole.Name = "Exporter";
            exporterRole.CanExport = true;
        }
        return exporterRole;
    }
    private ExtendedSecurityRole CreateUserRole() {
        ExtendedSecurityRole userRole = ObjectSpace.FindObject<ExtendedSecurityRole>(
            new BinaryOperator("Name", "Default"));
        if (userRole == null) {
            userRole = ObjectSpace.CreateObject<ExtendedSecurityRole>();
            userRole.Name = "Default";
            userRole.SetTypePermission<Task>(SecurityOperations.FullAccess, SecurityPermissionState.Allow);
            userRole.SetTypePermission<Employee>(SecurityOperations.ReadOnlyAccess, SecurityPermissionState.Allow);
            userRole.AddObjectPermission<PermissionPolicyUser>(SecurityOperations.ReadOnlyAccess,
                 "[Oid] = CurrentUserId()", SecurityPermissionState.Allow);
        }
        return userRole;
    }
}

 效果展示

运行WinForm或者ASP.NET，登录“Admin”用户，打开用户的详细视图。

 　　登录“Sam”用户，“Export To”是可用的；登录“John”，“Export To”不是可用的。

参考网址

[1] https://documentation.devexpress.com/eXpressAppFramework/113384/Task-Based-Help/Security/How-to-Implement-Custom-Security-Objects-Users-Roles-Operation-Permissions

[2]完整项目演示：www.devexpress.com/example=E3794

[3] PermissionPolicyRole 的属性信息：https://documentation.devexpress.com/eXpressAppFramework/DevExpress.Persistent.BaseImpl.PermissionPolicy.PermissionPolicyRole.members