How to choose a class whose method to call

Pirjo Ahvenainen

Hi all,

I would appreciate a hand in designing my code. So far I haven't found a way to do this.

I have a number of classes for different entities (currently 7 but there can be more in the future). I need a method in each of these classes that authorizes user's access to a file resource. Implementation varies but an exception must be thrown if user does not have access to the file in question.

Problem is, when a file is being accessed, I need to call the authorization method of the correct class based on the data on the file. Files are stored in a db table and one of the fields in that table determines which entity the file is related to and how to find which user has access to the file.

So I must read the file data from db, then see which entity it's related to and then call the authorization method of the correct class.

Is there a way in C# to accomplish this without having to make a switch case structure on the file field value?

Example of the classes used:

public class FileAttachment
{
// other FileAttachment class stuff
protected void AuthorizeFileAccess(FileAttachmentData file)
{
// file has a field which tells which entity it relates to
// here I need to choose which class to use based on the file data
}
}
// simplified example of a related entity
public class ChatMessage
{
public int SenderUserId;
public int RecipientUserId;
// here I need a method that checks that chat message sender's or recipient's
// user id matches the user id of the logged in user
// if not, throw exception
}
And this is what I want to avoid:
switch (file.SourceValue)
{
case "ChatMessageAttachmentFile":
var cm = new ChatMessage();
cm.AuthorizeAttachmentAccess();
case "OtherAttachmentFile":
var other = new SomeOtherClass();
other.AuthorizeAttachmentAccess();
default:
throw new Exception("Access denied");
}

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

Pirjo Ahvenainen5y ago
Hi,

Thanks for your reply.

What you suggest is actually something we have in place, user is authenticated using the .Net Identity framework and has claims but I must implement file authorization this way due to reasons in the software architecture that cause restrictions on what I can do.

The code I'm using would locate inside the OnActionExecuting method of a custom AuthorizeAttribute or in this case a bit deeper into the code structure to make sure the authorization is done regardless of files being accessed via the mvc website controller actions or a an API, or even some other way.

The main problem is to make a structure where each authorization method are in their own classes and I need to call the authorization method of the correct class based on the file source value.

I thought maybe I could utilize System.Action in some way but I'm not quite sure if that's the optimal solution.
Ronika Jency5y ago
Hi,

you can implement Identity server mechanism.
token - comibnation of user claim(detils) + secret key
each user must have the access token to acess the cs file.

using Authorize keyword you can access the web api cs file.