Q359904: How to modify objects/properties in code when the user does not have the permission seems to not work.

Hi Andrey,
Thanks for the suggestion.
Since I cannot set the SecurityStrategy.AssociationPermissionsMode property to 'Auto' (I want to deny the access to PayCardUsage from within secured Sessions) and I need to manage the modifications within the same transaction, may I ask if you see any side effect in making empty the Criteria of the PayCardUsage collection instead of loading it within a new variable?
I'm asking this because I would like to create an "automatic" way of just resetting the criteria of all the association members when I'm within an unsecured session. Otherwise I need to change lot of code to check one by one all the association that are used in code and load them explicitly.

Anyhow I have I question. In your code, what is the effect of the following instruction? lst is never used…

C#
var lst = new XPCollection<PayCardUsage>(e.Session).ToList();

Thanks in advance for your suggestions.
D

Hi Again,
I did some additional tests even trying setting the SecurityStrategy.AssociationPermissionsMode property to 'Auto'.
The point is that the collections of the objects arriving in the non Secure Session are still filtered by any permission that is set in the security system and I would like to avoid it just having the possibility of accessing to an "unfiltered" versions of the objects within the same transaction.
For your convenience I'm attaching a modified version of the original example. In this one you find that the AssociationPermissionMode is Auto but there is an objectPermission on the PayCardUsage.
Again in this case the PayCardUsages collection is still filtered by the SecuritySystem even in the non secured transaction.
Please could you kindly suggest me how to avoid this?
Many thanks in advance
D

Hello,

Indeed, if there are explicit Deny permissions, the Security System doesn't grant access to associated objects. You can learn more about how the Security System works with associations here: Permissions for Associated Objects.

To load these objects in your usage scenario, use the solution that I posted above:

C#
var lst = new XPCollection<PayCardUsage>(e.Session).ToList();

This code loads objects from a database, and as a result, the code that uses the PayCard.PayCardUsages collection can calculate the correct value. Please note that we didn't test this solution in all usage scenarios, so please thoroughly test it before using it in production.

I would also like to remind you that a simpler and more reliable solution for such tasks is to use a non-secured IObjectSpace. Did you try applying it? If so, what difficulties did you encounter?

Thanks,
Andrey

Hi Andrey
Thanks for the answer, I would like to ask for some additional clarifications.

"Indeed, if there are explicit Deny permissions, the Security System doesn't grant access to associated objects. You can learn more about how the Security System works with associations here: Permissions for Associated Objects"
I know this and this is the reason why I want to calculate the value from a Non Secure session that is within the directBaseUow_BeforeCommitTransaction. Do you mean that also this session is affected by the operations performed by the securitySystem? If yes, can you please suggest how to get an "non secured" session?

"This code loads objects from a database, and as a result, the code that uses the PayCard.PayCardUsages collection can calculate the correct value. Please note that we didn't test this solution in all usage scenarios, so please thoroughly test it before using it in production."
Sorry, this is not clear to me. If I look in the debugger, I see that from within the directBaseUow_BeforeCommitTransaction method the PayCardUsage list member of the PayCard object has a Criteria equal to the criteria I set in the ObjectPermission. This is the reason why I cannot access any record even if I think to be within a non secured session.
You suggest to load a collection within a variable (lst) that is never used in your code:

C#
var lst = new XPCollection<PayCardUsage>(e.Session).ToList();
        foreach (PayCard payCard in cardsToUpdate) {
            payCard.CalculatePayMoneyAmount(true);
        }

May I ask why the loading performed above also affect the payCard.PayCardUsage member that, as I mentioned before, is still Filtered with a "Criteria" expression?

"I would also like to remind you that a simpler and more reliable solution for such tasks is to use a non-secured IObjectSpace. Did you try applying it? If so, what difficulties did you encounter?
The example provided was extracted from a more complex use case in which the PayCard objects needs to be edited by the user within a web app in which we use permissions. According to my tests, if I use a non-secured objectSpace then I'm not able to access any kind of changes that are performed to the payCard objects that are not yet saved to the database, this is the reason why I would like to perform the logic within the same transaction but in a non secure session… Am I correct?

Thanks
D
D

Hi Andrey,
I investigated more your suggestion

C#
var lst = new XPCollection<PayCardUsage>(e.Session).ToList();
        foreach (PayCard payCard in cardsToUpdate) {
            payCard.CalculatePayMoneyAmount(true);
        }

and I'm confused.
I would like to underline that in the test project there is a single Deny ObjectPermission that is:

C#
userRole.AddObjectPermissionFromLambda<PayCardUsage>(SecurityOperations.FullObjectAccess, o=>o.PayMoney==1000, SecurityPermissionState.Deny);

In the original example (without the var lst==… row) with the debugger I see (in the foreach) that on the payCard.PayCardUsages collection there is a Criteria set that is exactly equal to the criteria I put in the object permission ({Not [PayMoney] = 1000.0m}). According to this I supposed that the collection is empty due to the criteria and then I asked why within a non secured session I still have the collections affected by the security permissions.

Then, according to your suggestion, I added the row:
var lst = new XPCollection<PayCardUsage>(e.Session).ToList();
Now what I see is:

• when the row is executed then the system loads from the database all the PayCardUsage records regardless of which Paycard needs to be updated (this could be a performance problem within a real environment).
• The ({Not [PayMoney] = 1000.0m}) criteria is still on the payCard.PayCardUsages collection but now the collection is populated with records that do not match the original criteria… Is this expected? If yes, could you kindly explain me why?

Thanks
D

Hello,

Do you mean that also this session is affected by the operations performed by the securitySystem? If yes, can you please suggest how to get an "non secured" session?

The Session instance that you get in the BeforeCommitTransaction event handler is 'unsecured' and you can get any data from a database using it.

May I ask why the loading performed above also affect the payCard.PayCardUsage member that, as I mentioned before, is still Filtered with a "Criteria" expression?

Creating a separate XPCollection (the 'lst' variable) loads data from a database. As a result, the PayCard class can access this data in the CalculatePayMoneyAmount method.

• when the row is executed then the system loads from the database all the PayCardUsage records regardless of which Paycard needs to be updated (this could be a performance problem within a real environment).

If you don't wish to load all PayCardUsage objects from a database, use a corresponding XPCollection overload that allows you to pass a criterion. For example: XPCollection(Session, CriteriaOperator, SortProperty[]) Constructor.
Loading data from a database doesn't change the Criteria property of the PayCard.PayCardUsages collection. Please modify this solution further to address your business needs.

According to my tests, if I use a non-secured objectSpace then I'm not able to access any kind of changes that are performed to the payCard objects that are not yet saved to the database, this is the reason why I would like to perform the logic within the same transaction but in a non secure session… Am I correct?

You are right. A non-secured object space can't access not-saved objects. Note, however, that using a non-secured object space is a much more reliable way to work with secured data, so consider rewriting your logic so that it doesn't require to work with not-saved objects. If you prefer to stay with the BeforeCommitTransaction event, research our source to learn how exactly it works and how you can extend it to meet your requirements. The following article may help you debug a working application: KA18843 - How can I debug DevExpress .NET source code using PDB files | DevExpress Support.

Thanks,
Andrey

Thanks Andrey,
You answered almost all my question except, could you please give me your opinion on:

"The ({Not [PayMoney] = 1000.0m}) criteria is still on the payCard.PayCardUsages collection but now the collection is populated with records that do not match the original criteria… Is this expected? If yes, could you kindly explain me why?"

At the end: explicitly loading the collections (like you did with the "lst" variable) may leads in loosing not-saved objects so I think that I cannot use it. I also think that it would be useful to update the original Q359904 making clear that the collections of the object available in the "non secured" session are also "filtered" according to possible permissions and for this reason cannot be used in a way of processing them "in the same transaction" but an explicit reload is required.

According to my understanding, and please correct me if I'm wrong, there is not any possibility of doing a processing method (that may result also in not saving the changes) on the payCard.PayCardUsages collection in which we can take in consideration both some new PayCardUsage record that are created but not yet saved and any other PayCardUsage that are already in the database but are denied due to some kind of permissions. Is this consideration correct?

Thanks
D