3

I am using Asp.Net Mvc Web api RC.

I wanted to hide the fields/properties of my model class using custom attribute. Below is my class:

public class Employee
{              
     public int EmpId { get; set; }       
     public string Name{ get; set; }

     //Wanted to hide this attribute based on custom logic. Like for a certain role, i want to hide the designation
     public string Designation{ get; set; }

     public string Department{ get; set; }
}

How can we achieve using Data Annotations. I mean i wanted to create a separate attribute to use in this manner:

[HideForRoles(Roles="Admin,Writer")]
public string Designation{ get; set; }

UPDATE :

As i am developing web api. The response is serialized to either XML or Json format depend upon the formatter. So better question would be how not to allow the fields to be serialize while writing to the response.

However one option could be using IgnoreDataMember attribute. Like

[IgnoreDataMember]
public string Designation{ get; set; }

But the above is a compile time declaration where i cannot impose any condition.

Question: How to ignore the field/property while serializing based on some condition at runtime?

Improve this question

4 Answers 4

Reset to default
2

Totally missed on the first go-round that you were using Web Api, my apologies.

What you want to do is to create a custom formatter.

There's a good article here on the flow/differences between MVC and Web Api (which I'm getting that you already understand, still some valid points here): http://lostechies.com/jimmybogard/2012/04/10/asp-net-web-api-mvc-viewmodels-and-formatters/

And here's a sample implementation of a custom formatter: http://www.tugberkugurlu.com/archive/creating-custom-csvmediatypeformatter-in-asp-net-web-api-for-comma-separated-values-csv-format

Building from that, you would use reflection to read from the attributes, building on the custom ActionFilterAttribute you would have to write, where you evaluate the user's roles and determine which fields should be omitted/included. Here's a sample of an action filter: https://github.com/MisterJames/MovieFu/blob/master/MovieFu/ActionFilters/UserNameFilter.cs

Hope this helps more.

Cheers.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

Custom formatter is the way of bridging the gap between model and response in Wb api. I think something/some layer is missing in MVC4 Web api. That is there in MVC in form of "Views". I will try to write custom formatter in near future. But there are different hurdles of default json and xml formatters come with the Web api. We have to totally ignore them and include our own in place. Hummm.. thinking....
1

Your best bet is to return a dynamic object. In this case you can say:

        dynamic viewModel = new ExpandoObject();
        viewModel.Id = 12;
        if(role == "Admin")
        {
            viewModel.SecureStuff = "Others should not see it";
        }
Improve this answer

4 Comments

This will work, but role becomes hard coded in his serialization at this point, which I think he was trying to avoid. I'm thinking a serializer with some custom action filter attributes would make a good NuGet package.
@MisterJames this is just a sample. Also using role-based security is hard-coding anyway.
Totally agree, it's just where you want it to live. If I'm using it, I would prefer role magic strings to live outside of the serializer.
Yes, i have implemented in the same way Ali has suggested but using reflection. It is just a simple thing to put a null for the field you don't want to display. However it will be displayed in XML response format but hidden in json format. The sample code i have given in my answer below.
0

It won't be as straightforward as that, as you'll need to have the fields conditionally rendering in the view. But you can get most of the way there through the attribute.

You will need to make your custom attribute meta-data aware, then check the attribute in your view. A solution is posted here: Can't get Custom Attribute Value in MVC3 HTML Helper.

Cheers.

Improve this answer

1 Comment

There are no "views" for me :( As i am using MVC4 Web Api, there are requests and responses based on formatters. But your's will be useful to other developers.
0

I have done the authorization checking in the model repository itself. Rather ideal way was to create custom formatters for hiding the certain fields based on some condition.

After getting the list of Employees from db and have them in list, i iterated again and place a NULL to the fields i don't want to display. The code i have written as:

foreach (var employee in listEmployees)
{
     //get all props. of Employees object using reflection
     var props = employee .GetType().GetProperties();

     //loop through each field to match with the field name to remove/place null
     foreach (var propertyInfo in props)
     {
          var fieldName = propertyInfo.Name;
          if (fieldsNamesToRemove .Contains(fieldName))
          {
                    propertyInfo.SetValue(employee , null, null);
          }
     }
 }

here fieldsNamesToRemove is a list that i created dynamically based on roles of current user.

This solution actually placing a NULL for the fields we do not want display. As a result in JSon format the fields are not displaying but in the XML the fields are displaying with syntax like lt; Designation i:nil="true"/ gt;, but manageable as we need to deal mostly with json response.

Thanks Ali and MisterJames for your valuable suggestions

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.