Question

I am using Asp.Net Mvc Web api RC.

I wanted to hide the fields/properties of my model class using custom attribute. Below is my class:

public class Employee
{              
     public int EmpId { get; set; }       
     public string Name{ get; set; }

     //Wanted to hide this attribute based on custom logic. Like for a certain role, i want to hide the designation
     public string Designation{ get; set; }

     public string Department{ get; set; }
}

How can we achieve using Data Annotations. I mean i wanted to create a separate attribute to use in this manner:

[HideForRoles(Roles="Admin,Writer")]
public string Designation{ get; set; }

UPDATE :

As i am developing web api. The response is serialized to either XML or Json format depend upon the formatter. So better question would be how not to allow the fields to be serialize while writing to the response.

However one option could be using IgnoreDataMember attribute. Like

[IgnoreDataMember]
public string Designation{ get; set; }

But the above is a compile time declaration where i cannot impose any condition.

Question: How to ignore the field/property while serializing based on some condition at runtime?

Answer 1

I have done the authorization checking in the model repository itself. Rather ideal way was to create custom formatters for hiding the certain fields based on some condition.

After getting the list of Employees from db and have them in list, i iterated again and place a NULL to the fields i don’t want to display.
The code i have written as:

foreach (var employee in listEmployees)
{
     //get all props. of Employees object using reflection
     var props = employee .GetType().GetProperties();

     //loop through each field to match with the field name to remove/place null
     foreach (var propertyInfo in props)
     {
          var fieldName = propertyInfo.Name;
          if (fieldsNamesToRemove .Contains(fieldName))
          {
                    propertyInfo.SetValue(employee , null, null);
          }
     }
 }

here fieldsNamesToRemove is a list that i created dynamically based on roles of current user.

This solution actually placing a NULL for the fields we do not want display. As a result in JSon format the fields are not displaying but in the XML the fields are displaying with syntax like lt; Designation i:nil=”true”/ gt;, but manageable as we need to deal mostly with json response.

Thanks Ali and MisterJames for your valuable suggestions