Starcounter/Starcounter.Authorization

Introduce attribute to skip permission check

Closed this issue · 2 comments

Some of the handlers or derived view model classes should not check permissions declared at parent class. PageSecurity checks should not be created. In general, we don't want developers to specify permission in every handler/class, so this situation is exceptional. It will be easy to achieve that by introducing dedicated Attribute for that purpose. My idea is SkipPermissionCheck. If anybody has better idea feel free to post it. To explain:

Current behavior:

[RequirePermission(typeof(ViewSth))]
partial class ViewModel {
    public void Handle(Input.DoSth action)
    {
    }
}

Check for DoSth Handler will be created (with ViewSth permission check)

Desirable behavior:

[RequirePermission(typeof(ViewSth))]
partial class ViewModel {
    [SkipPermissionCheck]
    public void Handle(Input.DoSth action)
    {
    }
}

Check for DoSth Handler won't be created (thanks to the introduced SkipPermissionCheck attribute)

We decided to introduce RequirePermission(false) instead of SkipPermissionCheck attribute.

This is outdated