EF Code First Intercept OWIN User.Identity To All Queries - asp.net-mvc

Question

I am using owin authentification on my MVC project.
I have Orders And Users(ApplicationUser) tables with navigation properties.
Every time I am querieng orders for authorized user i need to check user:
public class TestController : Controller
{
public ActionResult Index()
{
using (var ctx = new TestContext())
{
ctx.Orders.Where(o => o.User == User.Identity.Name).Where(...).ToList();
}
}
}
If i forget to check it somewhere, user will get access to all orders.
I want something like or some better way to do it:
[InterceptQuery]
public Expression<Func<Orders, Boolean>> FilterUser(){
return o => o.Where(o => o.User == HttpContext.User.Identity.Name);
}
And it will always fire when i am quering Orders table.

Answer 1

Create a repository around your context and let your code uses the repository so you will add the filtering in the repository method, and by doing this every call to the repository method will get the filtered data, so yku don't repeat yourself and filter everywhere, just in the repository.
EDIT :
You can implement the repository like this:
// an interface around the current user, so you can mock this later
// and test your repository with your own username.
public interface ICurrentUser
{
string UserName { get; }
}
// the implementation of the current user which get the username from the current identity.
public class CurrentUser : ICurrentUser
{
public string UserName
{
get
{
return HttpContext.Current.User.Identity.Name;
}
}
}
// a simple repository to get the orders filtered by the current user.
public interface IOrderRespositroy
{
List<Order> GetAllOrders();
}
// the implementation of the orderrepository interface,
// this get the dbcontext, which get the orders from the data base,
// but you will filter all orders by the username
public class OrderRepository : IOrderRespositroy
{
private readonly TestContext _context;
public OrderRepository(TestContext context, ICurrentUser currentUser)
{
_context = context;
}
public List<Order> GetAllOrders()
{
return _context.Orders.Where(o=> o.User == currentUser.UserName).Where()
}
}
// your new controller which depends on IOrderRepository, and your code will not be polluted
// by the code to filter the orders by the current user.
public class TestController : Controller
{
private readonly IOrderRespositroy _repository;
public TestController(IOrderRespositroy repository)
{
_repository = repository;
}
public ActionResult Index()
{
var orders = _repository.GetAllOrders();
// .
// .
// .
}
}
Now you can setup your dependencies using an IoC container like Autofac, but by using the above pattern you can easily change the logic to filter the orders if you for example decided that all orders should be filtered by userName and userAccess (for example).
Hope that helps.

Answer 2

I would suggest you to overwrite the AuthorizeAttribute and have it applied on Actions and/or Controllers as needed.
public class OrdersAuthorizeAttribute : AuthorizeAttribute
{
protected virtual bool AuthorizeCore(HttpContextBase httpContext) {
{
base.AuthorizeCore(httpContext);
IPrincipal user = httpContext.User;
if (!user.Identity.IsAuthenticated) {
return false;
}
return ctx.Orders.FirstOrDefault(o => o.User == user.Identity.Name) != null;
}
}