Question

I’m writing a WCF REST Service that has a mobile client.
The mobile client uses an “authToken” along the lines of OAuth to represent a user’s identity.
The authToken is a string parameter which, at the moment, is passed to (almost) every method in the service.

What I’d like to do is write something akin to an MVC ActionFilter -which runs for every method and does the authToken processing: validate the token, lookup the related account and return the Account instance object – a failed lookup means an error is returned and my method isn’t even called.

I’ve found these two questions which are kind of similar to what I want to do, but it would appear the tricky part is introducing the Account instance somehow? I can quite happily create my [AuthOperation] attribute which implements the IOperationBehavior interface, but I can’t work out what I need to do in order to introduce my new Account instance one I’ve looked it up.

        public object Invoke(object instance, object[] inputs, out object[] outputs)
    {
        Account = new Account(_context);
        if (!Account.LoadByAuthToken(((string)inputs[0]).FromEncodedString()))
        {
            outputs = new object[0];
            return new ErrorResponse
                    {
                        Code = ResponseCode.Exception.ToString(),
                        DebugMessage = MyStrings.AuthToken_NotFound
                    };
        }

How do I pass my Account instance into the invoked method?

        object result = this._originalInvoker.Invoke(instance, IntroduceAccount(inputs,Account), out outputs); 
        return result;
    }

Ultimately what I want is to have

public MyResponse GetContacts(string authToken)

exposed in the service, but

public MyResponse GetContacts(Account acct)

or

public MyResponse GetContacts(Account acct, string authToken)

actually implemented on the server – and have the authToken -> Account conversion handled by the “Action Filter”.

I’d even be happy if the answer is “Don’t use WCF, do it like this….” as long as whatever else is proposed also fits my other requirements.

Answer 1

It turns out that I am just really dumb and (almost) achieving my goal was actually fairly straightforward.

In the (Invoke) method above you have access to the instance that is being invoked….So….

        var wcfAccountRequired = instance as IWcfAccountRequired;
        if (wcfAccountRequired != null)
        {
            (wcfAccountRequired).Account = Account;
        }

…I just make sure that a particular interface is being implemented by (instance) and assign the Account property on it. If I don’t successfully retrieve an Account I can just return the error and not invoke anything.

Not perfect, but solves my problem succinctly.