Starcounter/Starcounter.Authorization

Permissions defined in subpage handlers are not checked at all

Closed this issue · 1 comments

Described in the example below. I expect EditSomething permission to be checked when SomethingItem Handle(Input.Delete action) is executed.

[RequirePermission(typeof(ViewSomething)]
partial class SomethingPage, IBound<Something> {
        
    [RequirePermission(typeof(EditSomething))]
    public void Handle(Input.Delete action)
    {
        //works as expected - permission denied and nothing here executed
    }
   
    [SomethingPage_json.SomeItems]
    partial class SomethingItem : Json, IBound<SomeItem>
    {
        [RequirePermission(typeof(EditSomething))]
        public void Handle(Input.Delete action)
        {
            //executed, permission is not checked at all
        }
    }
}

cc @joozek78

Seems like there is a problem if there is more than 2-level nesting.Investigating