Locking Down All DataPortal Actions On All Objects by Default

[saulyt]

I am trying to lock down all DataPortal Actions on my business objects by default. I created a base BO thati inherit from:

public abstract class MyBusinessBase<T> : Csla.BusinessBase<T> where T : Csla.BusinessBase<T>
{
  
    [ObjectAuthorizationRules]
    public static void AddObjectAuthorizationRules()
    {
        SecurityRuleRegistrar.ApplyConventionRules(typeof(T));
    }
}

public static class SecurityRuleRegistrar
{
    /// <summary>
    /// Applies the Default Deny security convention to the specified object type.
    /// </summary>
    public static void ApplyConventionRules(Type objectType)
    {
        var actions = new[]
        {
            AuthorizationActions.CreateObject,
            AuthorizationActions.GetObject,
            AuthorizationActions.EditObject,
            AuthorizationActions.DeleteObject,
            AuthorizationActions.ExecuteMethod
        };

        foreach (var action in actions)
        {
            // 1. Check the central registry
            if (PublicSecurityRegistry.IsActionPublic(objectType, action))
            {
                continue;
            }

            // 2. Add the strict rule statically using the fully qualified type name
            Csla.Rules.BusinessRules.AddRule(objectType, new ConventionPermissionRule(action, objectType));
        }
    }
}

public class ConventionPermissionRule : AuthorizationRule
{
    // 1. Explicitly store the type being secured
    private readonly Type _objectType;

    // 2. Update the constructor to pass ONLY the action to the base class
    // (This tells CSLA it is an object-level rule)
    public ConventionPermissionRule(AuthorizationActions action, Type objectType)
        : base(action)
    {
        _objectType = objectType ?? throw new ArgumentNullException(nameof(objectType));
    }

    protected override void Execute(IAuthorizationContext context)
    {
        var principal = context.ApplicationContext.Principal as System.Security.Claims.ClaimsPrincipal;
        string userName = principal?.Identity?.Name ?? "Anonymous/Null";
        bool isAuthenticated = principal?.Identity?.IsAuthenticated ?? false;

        System.Diagnostics.Debug.WriteLine($"[AUTH START] User: '{userName}' (Auth: {isAuthenticated}) requesting '{Action}' on '{_objectType.Name}'");

        // 1. NULL GUARD
        if (principal == null)
        {
            System.Diagnostics.Debug.WriteLine($"[AUTH DENIED] Principal is null for {_objectType.Name}.{Action}");
            context.HasPermission = false;
            return;
        }

        // 2. SYSTEM BYPASS (God Mode)
        bool isElevated = principal.Identities.Any(i => i.AuthenticationType == SecurityConstants.SystemAuthenticationType);
        if (isElevated)
        {
            System.Diagnostics.Debug.WriteLine($"[AUTH APPROVED] System Bypass granted for {_objectType.Name}.{Action}");
            context.HasPermission = true;
            return;
        }

        // 3. STANDARD USER CHECK
        string requiredClaim = $"{_objectType.Name}.{Action}";
        if (principal.HasClaim(SecurityConstants.ClaimType, requiredClaim))
        {
            System.Diagnostics.Debug.WriteLine($"[AUTH APPROVED] User has required claim '{requiredClaim}'");
            context.HasPermission = true;
            return;
        }

        // 4. DEFAULT DENY
        System.Diagnostics.Debug.WriteLine($"[AUTH DENIED] User lacks required claim '{requiredClaim}'");
        context.HasPermission = false;
    }
 }

Yet I am finding that randomly when I call SaveAsync() on my BO, it will allow it to save even though I did not add the EditObject action for that BO to my public registry.

I am calling SaveAsync() from a Blazor WASM component and the DataPortal is running on the server. Usually when it does allow it to save it, it is on the first try after starting the debugger, but it is not always reproducible. When it does allow the save, I do not see any of the logging from the Execute on ConventionPermissionRule.

Can anyone shed some light on what I am doing wrong and if there is a better way to handle this.

Thank you

[TheCakeMonster]

What version of Csla are you using? I am wondering if this is a version that still contains the Blazor authorization bugs

[saulyt]

Latest version. 10.1 Thanks

…

On Thu, Aug 6, 2026, 6:19 AM TheCakeMonster ***@***.***> wrote: What version of Csla are you using? I am wondering if this is a version that still contains the Blazor authorization bugs — Reply to this email directly, view it on GitHub <#4877?email_source=notifications&email_token=AJLAXO7DHE4BAKQQQU2TRUD5IRLTVA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZZGE4TGOJTUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-17919393>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJLAXOYTTOOE34BFWT2TFI35IRLTVAVCNFSNUABGKJSXA33TNF2G64TZHM4DAOBVG42DSO2ENFZWG5LTONUW63R3GEYDKNJUGM3THILWAI> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AJLAXO6U5BJMWAR265JL5ET5IRLTVA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZZGE4TGOJTUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVJTG633UMVZF62LPOM> and Android <https://github.com/notifications/mobile/android/AJLAXOZVB4ECTMBQERKPHY35IRLTVA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZZGE4TGOJTUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVZTG633UMVZF6YLOMRZG62LE>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

[TheCakeMonster]

OK, it's not beijg caused by what I thought then.

I'm not really sure why it's failing. However, as shown by your own code, auth rules are more about the initiation of operations - starting an edit in your case - than running the data portal operation itself. It might not be the best way to do what you want.

There are points of extensibility for validation and authorisation in Csla, and using the latter feels like the best approach for safeguarding the server-side operations themselves.

To do this, you would create a class implementing IAuthorizeDataPortal - ideally extending ActiveAuthorizer - and put your logic there.

This doesn't really answer your question entirely. I wonder if it might be a bug in the one bit of code you didn't show - PublicSecurityRegistry - but that wouldn't explain why the debugging information doesn't show up, so I don't think that's really it.

[saulyt]

@TheCakeMonster , what do you mean by extending ActiveAuthorizer? It does not seem to be virtual.

I went away from placing adding the rule on the base class to source generating the rule, and I am no longer using the PublicSecurityRegistry to make actions public. I am using an attribute on the class to tell the source generator not to include the action if it is public. This did not fix my issue. It still allows through actions that should be locked randomly.

For completeness, this is what the PublicSecurityRegistry looked like

public static class PublicSecurityRegistry
{
    // A dictionary mapping a Business Object Type to a set of public actions
    private static readonly Dictionary<Type, HashSet<AuthorizationActions>> _publicActions = new();

    static PublicSecurityRegistry()
    {
        // =====================================================================
        // EXPLICIT PUBLIC ENDPOINTS REGISTRY
        // Any action listed here will BYPASS the default convention security.
        // =====================================================================
        RegisterPublicAction(typeof(Quote), AuthorizationActions.CreateObject, AuthorizationActions.GetObject);
    }

    private static void RegisterPublicAction(Type objectType, params AuthorizationActions[] actions)
    {
        if (!_publicActions.ContainsKey(objectType))
        {
            _publicActions[objectType] = new HashSet<AuthorizationActions>();
        }

        foreach (var action in actions)
        {
            _publicActions[objectType].Add(action);
        }
    }

    /// <summary>
    /// Checks if a specific action on a specific type is explicitly registered as public.
    /// </summary>
    public static bool IsActionPublic(Type objectType, AuthorizationActions action)
    {
        if (_publicActions.TryGetValue(objectType, out var allowedActions))
        {
            return allowedActions.Contains(action);
        }
        return false;
    }
}

With the source gen I add an attribute to the class:

[AllowPublicActionsAttribute(Create = true, Read = true)]
public partial class Quote

And that will cause the source gen to leave out Create and Get:

public partial class Quote
{
    [ObjectAuthorizationRules]
    public static void AddObjectAuthorizationRules()
    {
        var type = typeof(Quote);
        BusinessRules.AddRule(type, new ExplicitPermissionRule(AuthorizationActions.EditObject, "Quote.EditObject"));
        BusinessRules.AddRule(type, new ExplicitPermissionRule(AuthorizationActions.DeleteObject, "Quote.DeleteObject"));
        BusinessRules.AddRule(type, new ExplicitPermissionRule(AuthorizationActions.ExecuteMethod, "Quote.ExecuteMethod"));
    }
}

[saulyt]

I implemented @TheCakeMonster solution of extending ActiveAuthorizer and had the exact same random issue. After adding a whole lot of debugging and feeding it to AI, the mystery was solved, It had to do with the Blazor lifecycle and where the code was running.

Thank you @TheCakeMonster for your assistance. Extending ActiveAuthorizer is definitely a cleaner solution.

[TheCakeMonster]

Ah great, I'm glad you sorted it.

Sorry for the late reply. I didn't think about the details of how to extend the type, and you are right, as it's not virtual that makes it a little harder. However, you could use dependency injection to inject an instance of ActiveAuthorizer into the constructor of your new type, call the method on it and then call your logic after it (or before it, if you prefer).

You would have to ensure that the ActiveAuthorizer type was directly registered to the DI container for that to work, even though you are substituting the definition of the type used for IAuthorizeDataPortal through the appropriate configuration method.

The idea of using the existing class somehow was simply to minimise your custom code, and benefit from any future enhancements or bug fixes to the original code.

Hope that helps.

[saulyt]

I just inherited from and declared the interface. That seemed to work

public class DataPortalAuthorizer : ActiveAuthorizer, IAuthorizeDataPortal

Thanks for your help.