MVC repository pattern, how to security trim?

Question

Currently I am writing a web application in MVC 4. I am using a generic repository pattern. It works well. So I have something like the followings,

public class AddressRepository : IAddressRepository
    {
        private AISDbContext context = new AISDbContext();

        public IQueryable<Address> GetAddresses()
        {
            return context.Address;
        }

    }

But now I need to add something that filters the data more. Based on the logged in user's role, this data should be more filtered.

something like this..

public IQueryable<Address> GetAddresses()
{
   return context.Address.where(x=>x.haspermissions = CURENTUSER.Role);
 }

Now I could always add another function like this, but I want to try an be general. I want to know if I can just use the first bit of code and inherit from another class, that just applies the security trimming. This way I do not have to rewrite all my queries, I simply tell each class to inherit from the security trimmer. hope that makes sense..

Thanks

updated code

public class AddressRepository : SecureRepositoryBase<Address>, IAddressRepository
    {
        private AISDbContext context = new AISDbContext();

        public IQueryable<Address> GetAll()
        {
            return base.RetrieveSecure(context.Address, 1);           
        }
}

 public abstract class SecureRepositoryBase<T> where T : ISecuredEntity
    {
        public IQueryable<T> RetrieveSecure(IQueryable<T> entities, int currentUser)
        {
            return entities.Where(e => e.InspectorId == currentUser);         
        }
    }

 public interface ISecuredEntity
    {
        int? InspectorId { get; set; }
    }

 public class Address: ISecuredEntity
    {
        public int COESNo { get; set; }
        public int Postcode { get; set; }
        public int AuditAuthNo { get; set; }
        public bool? SelectedForAudit { get; set; }
        public int? RECId { get; set; }
        public string CustomerName { get; set; }
        public string CustomerAddress { get; set; }
        public int? CustomerSuburbId { get; set; }
        public int? InspectorId { get; set; }
        public DateTime? AuditDate { get; set; }
        public int? AuditType { get; set; }
        public int? UploadType { get; set; }
        public string COESImage { get; set; }
        public DateTime CreatedDate { get; set; }
        public int? CreatedBy { get; set; }
        public DateTime? ModifiedDate { get; set; }
        public int? ModifiedBy { get; set; }

        public virtual UserDetails Inspector { get; set; }
        public virtual Postcodes CustomerSuburb { get; set; }
        public virtual ResponsiblePerson RPerson { get; set; }
        public virtual UserProfile CreatedByUser { get; set; }
        public virtual UserProfile ModifiedByUser { get; set; }
    }

Answer 1

Create a base class that converts each query to one where the permissions are checked and let your repository classes inherit from that.

Something like this:

public interface ISecuredEntity
{
    IEnumerable<string> Permissions { get; }
}

public class Address : ISecuredEntity
{
    public IEnumerable<string> Permissions { get; set; }
}

public class AddressRepository : SecureRepositoryBase<Address>, IAddressRepository
{
    private AISDbContext context = new AISDbContext();

    public IQueryable<Address> GetAddresses()
    {
        return base.RetrieveSecure(context.Address, CURENTUSER);
    }
}

public abstract class SecureRepositoryBase<T>
    where T : ISecuredEntity
{
    public IQueryable<T> RetrieveSecure(IQueryable<T> entities, IUser currentUser)
    {
        return entities.Where(e => e.Permissions.Contains(currentUser.Role));
    }
}

Answer 2

You might want to look into global filters. I'm including a brief example of how it would work:

public class AISDbContext : DbContext
{
    public void ApplyFilters(IList<IFilter<AISDbContext>> filters)
    {
        foreach(var filter in filters)
        {
            filter.DbContext = this;
            filter.Apply();
        }
    }
}

public interface IFilter<T> where T : DbContext
{
    T DbContext {get; set;}
    void Apply();
}

public class AdminRoleFilter : IFilter<AISDbContext>
{
    public AISDbContext _dbContext {get; set;}
    public void Apply()
    {
        _dbContext.Address = new FilteredDbSet(_dbContext, d => d.haspermissions = "Admin");
    }
}

The details of the FilteredDbSet are really extensive and can be found here.

Then the implementation of your DbContext in your AddressRepository would look like this:

var context = new AISDbContext();
context.ApplyFilters(new List<IFilter<AISDbContext>>()
    {
        new AdminRoleFilter()
    });

public List<Address> GetAddresses()
{
    return context.Address.ToList();
}

Answer 3

MVC repository pattern, how to security trim?

Repository should not take care of access control / security trimming. It merely provides methods to query for domain objects.

In the following code

function GetAddresses() as IQueryable(of Address)
function GetAddressesInspectedBy(Inspector as Inspector) as IQueryable(of Address)

The method GetAddresses will return all addresses available.

The method GetAddressesInspectedBy will return all addresses inspected by the concrete inspector.

These two methods are clearly distinct and coexist with each other in repository. Both methods should be available, but what method is to be called depends on business logic / access control outside repository.

But now I need to add something that filters the data more. Based on the logged in user's role, this data should be more filtered.

Data returned to the user should not be based on user's role! Instead it should be based on user's request! And whether the request may be executed or not depends on user's role.

For example, administrator role user may be allowed to request each of the following

1. all addresses,
2. addresses by concrete inspector,
3. addresses inspected by himself.

Each of the three request types returns different results, independent on administrator role!

While inspector role user may be allowed to request only

1. addresses inspected only by himself.

Application receives request, checks whether user is allowed to do this request and calls repository methods corresponding to the request.