Question

I am trying to implement privileges using NHibernate, and what I want to do, is each time there is a Select query, check what the return type is, and if it is a security enabled type (such as invoices) i want to add restrictions to the ICriteria object, to restrict retrieving only certain records (According if the user has read all, or read own privileges).

I managed to implement these kind of privileges for Insert and Update using

NHibernater.Event.IPreUpdateEventListener
NHibernater.Event.IPreInsertEventListener

but unfortunately the IPreLoadEventListener is called after the database is queried, and therefore it is waste as the filtering will be done locally on the computer rather then by the database.

Does anyone know if NHibernate provides some sort of event that is called before a query is executed?

Answer 1

If you’re able to use it, check out Rhino.Security It does exactly what you’re trying to do. Even if you’re unable to use it, you can then see his implementation of this problem.