Locking Down All DataPortal Actions On All Objects by Default #4877

public abstract class MyBusinessBase<T> : Csla.BusinessBase<T> where T : Csla.BusinessBase<T>
{
  
    [ObjectAuthorizationRules]
    public static void AddObjectAuthorizationRules()
    {
        SecurityRuleRegistrar.ApplyConventionRules(typeof(T));
    }
}

public static class SecurityRuleRegistrar
{
    /// <summary>
    /// Applies the Default Deny security convention to the specified object type.
    /// </summary>
    public static void ApplyConventionRules(Type objectType)
    {
        var actions = new[]
        {
            AuthorizationActions.CreateObject,
            AuthorizationActions.GetObject,
            AuthorizationActions.EditObject,
            AuthorizationActions.DeleteObject,
            AuthorizationActions.ExecuteMethod
        };

        foreach (var action in actions)
        {
            // 1. Check the central registry
            if (PublicSecurityRegistry.IsActionPublic(objectType, action))
            {
                continue;
            }

            // 2. Add the strict rule statically using the fully qualified type name
            Csla.Rules.BusinessRules.AddRule(objectType, new ConventionPermissionRule(action, objectType));
        }
    }
}

public class ConventionPermissionRule : AuthorizationRule
{
    // 1. Explicitly store the type being secured
    private readonly Type _objectType;

    // 2. Update the constructor to pass ONLY the action to the base class
    // (This tells CSLA it is an object-level rule)
    public ConventionPermissionRule(AuthorizationActions action, Type objectType)
        : base(action)
    {
        _objectType = objectType ?? throw new ArgumentNullException(nameof(objectType));
    }

    protected override void Execute(IAuthorizationContext context)
    {
        var principal = context.ApplicationContext.Principal as System.Security.Claims.ClaimsPrincipal;
        string userName = principal?.Identity?.Name ?? "Anonymous/Null";
        bool isAuthenticated = principal?.Identity?.IsAuthenticated ?? false;

        System.Diagnostics.Debug.WriteLine($"[AUTH START] User: '{userName}' (Auth: {isAuthenticated}) requesting '{Action}' on '{_objectType.Name}'");

        // 1. NULL GUARD
        if (principal == null)
        {
            System.Diagnostics.Debug.WriteLine($"[AUTH DENIED] Principal is null for {_objectType.Name}.{Action}");
            context.HasPermission = false;
            return;
        }

        // 2. SYSTEM BYPASS (God Mode)
        bool isElevated = principal.Identities.Any(i => i.AuthenticationType == SecurityConstants.SystemAuthenticationType);
        if (isElevated)
        {
            System.Diagnostics.Debug.WriteLine($"[AUTH APPROVED] System Bypass granted for {_objectType.Name}.{Action}");
            context.HasPermission = true;
            return;
        }

        // 3. STANDARD USER CHECK
        string requiredClaim = $"{_objectType.Name}.{Action}";
        if (principal.HasClaim(SecurityConstants.ClaimType, requiredClaim))
        {
            System.Diagnostics.Debug.WriteLine($"[AUTH APPROVED] User has required claim '{requiredClaim}'");
            context.HasPermission = true;
            return;
        }

        // 4. DEFAULT DENY
        System.Diagnostics.Debug.WriteLine($"[AUTH DENIED] User lacks required claim '{requiredClaim}'");
        context.HasPermission = false;
    }
 }