Question

I am trying to create a Custom Attribute for a ServiceStack Service with which I can control each method in the service Class.

This is the attribute class that I am implementing.

[AttributeUsage(AttributeTargets.Method|AttributeTargets.Class , Inherited = false, AllowMultiple = false)]
public class MyRequestFilterAttribute:RequestFilterAttribute
{

    public string Provider { get; set; }

    public MyRequestFilterAttribute(ApplyTo applyTo): base(applyTo)
    {
        this.Priority = (int) RequestFilterPriority.Authenticate;
    }

    public MyRequestFilterAttribute():this(ApplyTo.All)
    {

    }

    public MyRequestFilterAttribute(ApplyTo applyTo, string provider): this(applyTo)
    {
        this.Provider = provider;
    }

    public MyRequestFilterAttribute(string provider): this(ApplyTo.All)
    {
        this.Provider = provider;
    }

    public override void Execute(IHttpRequest req, IHttpResponse res, object requestDto)
    {}
}

This is the Service Class

[MyRequestFilter(ApplyTo.All)]
public class TodoService : RestServiceBase<Todo>
{
    public TodoRepository Repository { get; set; }                  
    public override object OnGet(Todo request)
    {
        if (request.Id == default(long))
            return Repository.GetAll();

        return Repository.GetById(request.Id);
    }
    public override object OnPost(Todo todo)
    {
        return Repository.Store(todo);
    }
    public override object OnPut(Todo todo)
    {
        return Repository.Store(todo);
    }
         [MyRequestFilter("Admin")]
    public override object OnDelete(Todo request)
    {
        Repository.DeleteById(request.Id);
        return null;
    }
    public object GetDetailsofALL()
    {
        return null;
    }
}

I am able to get control on the Methods when I place the attribute on the Class level.
i.e

[MyRequestFilter(ApplyTo.All)]
public class TodoService : RestServiceBase<Todo>{}

What I require is to place an attribute on the method level as well and do some authentication such that only an admin has the right to perform this method of the service.
But when I place this attribute in the Delete method it is not working and the custom filter attribute is not getting hit. Only the class level attribute call works.

[MyRequestFilter("Admin")]
public override object OnDelete(Todo request){}

Is it possible to set the permission/filter attribute from the method level? If yes, how can I implement this?

Answer 1

No it’s not possible to add it on the method. You can add it on the service class or the Request DTO and use the ApplyTo method filter to tell servicestack which methods it should apply to, e.g:

[MyRequestFilter(ApplyTo.All)]
[MyRequestFilter(ApplyTo.Delete, "Admin")]
public class TodoService : RestServiceBase<Todo> { ... }

You can also refer to the implementation of the [RequiredRole] and [RequestPermission] attributes for examples of Request Filter attributes that support this.