Hi, I hope everybody is doing great...!

I have a situation and if you be so kind, I want a expert opinion about the LLBL.

I am working in a security library, and I need to filter out the data that the user retrieves from the database. So, when the an application takes data it must filter it before show it to the user. BUT I don't want that the person who is in charge of design a module(a programmer) has to worry of filter the data, I was thinking that if I can make the "DataAccessAdapter" class ask in the "FetchEntity" method to the security object about the privileges, the programmer just need to use a "DataAccessAdapter" object. So I was thinking of alter the template that use the LLBL to generate the code.

What I am asking is, can I override the "FetchEntity" method from the templates or I need to do it somewhere else or I can't do it at all? what do you recommend me?

Thanks-

You should derive a class from DataAccessAdapter and override FetchTypedList, FetchEntity, FetchNewEntity, FetchEntityCollection, to filter out data you dont want the user to see: first call the base class, then throw out data you don't want, or append predicates to the filter for example if you want the user to only see its own data for example. By deriving a new class, you don't have to alter the existing code

I tried but I have no idea of how add a PredicateExpression to the filterBucket while I override the method.

what I am trying to do is keep de DataAccessAdapter generic, so I just have to modify it once.

I want to know if there is a way to alter the filterBucket without referring the DataBaseGeneric Class, or in ultimate situatuion, alter the final query that the DataAccessAdapter gives to the MSSQL.

ha1o wrote:

I tried but I have no idea of how add a PredicateExpression to the filterBucket while I override the method.

what I am trying to do is keep de DataAccessAdapter generic, so I just have to modify it once.

I want to know if there is a way to alter the filterBucket without referring the DataBaseGeneric Class, or in ultimate situatuion, alter the final query that the DataAccessAdapter gives to the MSSQL.

You could ask the security object to produce that predicate expression for you so you can add it. FetchEntity accepts an entity instance for filling it. It will call CreatePrimaryKeyFilter which returns a predicateexpression for the PK filter. You can override it, first call the base method, and then append your additional filter to the PK filter if the user is or isn't allowed to fetch the data.

Altering the actual dataaccessadapter code isn't recommended, and often not required as you can customize it through inheritance.

Otis wrote:

You could ask the security object to produce that predicate expression for you so you can add it.

This is what I was trying to do. But the PredicateFactory class is in the DatabaseGeneric Proyect, so I cannot create a class which alter the filterBucket just by inherit from the DataAccessAdapter class.

Maybe I was the one that didn't explain right the situation. The security class is standard for all applications, depends of who is the user, the security object will have an entity field name and a array of string with possible values that the field can have. So I have a field name and an array of values. My idea is like add something like this: (" AND " + keyField + " IN (" + for(values[cont]) + ")") to the filterBucket. As I said, I tried to use the predicate expression but I didn't find a way to do it without binding the new class to a DatabaseGeneric proyect; and I cannot do this because the security must be generic for all the systems and their databases.

I am considering the option of throw out the unwanted data after the Fetch process, but I want to use every possibility of make the application the most efficient possible. So I am looking for a way of add the string values to the filterBucket before call the Fetch method without using the DatabaseGeneric proyect.

ha1o wrote:

Otis wrote:

You could ask the security object to produce that predicate expression for you so you can add it.

This is what I was trying to do. But the PredicateFactory class is in the DatabaseGeneric Proyect, so I cannot create a class which alter the filterBucket just by inherit from the DataAccessAdapter class.

You don't need the PredicateFactory to create predicates . If you have an entity, you can use the fields in that entity to produce a filter, using FieldCompareValuePredicate instances for example.

Though what I was refering to was: the security object is in a separate project, it has a reference to your dbgeneric project, and your dbspecific project has a reference to your security project. the dataaccessadapter derived class calls the security object, which produces the extra filter, and the dataaccessadapter derived class then moves on like nothing happened.

Maybe I was the one that didn't explain right the situation. The security class is standard for all applications, depends of who is the user, the security object will have an entity field name and a array of string with possible values that the field can have. So I have a field name and an array of values. My idea is like add something like this: (" AND " + keyField + " IN (" + for(values[cont]) + ")") to the filterBucket. As I said, I tried to use the predicate expression but I didn't find a way to do it without binding the new class to a DatabaseGeneric proyect; and I cannot do this because the security must be generic for all the systems and their databases.

Ok. You could do this. myEntity is the entity to fetch, values is an array (or arraylist) of values. To produce the filter above do in your security object's method, which receives an IEntity2 object, myEntity, and then selects the list of values to apply: myFilter.AddWithAnd(new FieldCompareRangePredicate(myEntity.Fields[keyFieldName], null, values)); After that myFilter has the range filter applied to it. To be sure that the persistence info is filled in, you have to add this predicate a.s.a.p., so OnFetchEntity is too late for example.

This way, it doesn't require a reference to your dbgeneric project, as you use generic code from the ORMSupportClasses

Otis, Hi.

I just want to let you know that I manage to manipulate the filterBucket, and the LLBL code is running well with my security project.

• thanks for your help

I'm trying to apply security to FetchEntity but have hit a bit of brick wall.

I've created a SecurityController class in another Project with a method called GetSecurityPredicates() who's function is to return an IPredicateExpression with the additional filters required for the IEntity2 that was passed in. It's all hardcoded at the moment, but the intention is that the predicates will be pulled from tables eventually.

public IPredicateExpression GetSecurityPredicates(IEntity2 entityToSecure)
{
    string keyField = String.Empty;
    string compareValue = String.Empty;
    IPredicateExpression exp = new PredicateExpression();

    // Get details of what needs filtering for entityToSecure
    if (entityToSecure.LLBLGenProEntityName == "PersonEntity")
    {
        keyField = "Surname";
        compareValue = "Abbott";

        exp.AddWithAnd(new FieldCompareValuePredicate(entityToSecure.Fields[keyField], null, ComparisonOperator.NotEqual, compareValue));
    }
    return exp;
}

I overload the DataAccessAdapter's FetchEntity method and call my Security Predicates like this:

public override bool FetchEntity(IEntity2 entityToFetch)
{
    // Get Security Predicates for this entity
    SecurityController controller = new SecurityController();
    IPredicateExpression spe = controller.GetSecurityPredicates(entityToFetch);
    
    // Get Predicate Expression for this fetch
    IPredicateExpression pe = base.CreatePrimaryKeyFilter(entityToFetch.PrimaryKeyFields);

    // Add to Security Predicates to the standard predicate
    // Errr......

    // Call base FetchEntity
    return base.FetchEntity(entityToFetch);
}

The trouble is, I can't work out how to apply my Security Predicate Expression (spe) onto the Predicate Expression from the PrimaryKeyFilter (pe).

Any ideas?

Ant