EF6 - 有条件地更新SaveChanges（）上的Entity属性

Question

I am using EF6 code-first (from existing db) to do CRUD operations. I am going to write some mock code here to explain since I can't paste the real code due to some copy right issues. Here is my entity:

    public partial class Person : EntityBase
{
    public long Id { get; set; } // ID (Primary key)
    public string LastName { get; set; } // LastName (length: 50)
    public string FirstName { get; set; } // FirstName (length: 50)
    public string SocialSecurity { get; set; } // SocialSecurity (length: 50)
    public long CreatedById { get; set; } // CreatedByID
    public System.DateTime CreatedDate { get; set; } // CreatedDate
    public long UpdatedById { get; set; } // UpdatedByID
    public System.DateTime UpdatedDate { get; set; } // UpdatedDate
    public byte[] TimeStamped { get; set; } // TimeStamped (length: 8)
}

I have a generic repository to do the CRUD operations.

    public class Repository<T> : IRepositoryAsync<T> where T : class, IObjectState
{
    private readonly IDataContextAsync context;
    private readonly DbSet<T> dbSet;
    //private read-only IUnitOfWorkAsync uow;

    public Repository( IDataContextAsync _context )
    {
        context = _context;
        dbSet = ( (DbContext)context ).Set<T>();
    }

    public virtual IDataContextAsync Context { get { return context; } }
    public IDbSet<T> DbSet { get { return dbSet; } }
    public T FindOne( Expression<Func<T, bool>> predicate )
    {
        return dbSet.SingleOrDefault( predicate );
    }
    public IQueryable<T> FindBy( Expression<Func<T, bool>> predicate )
    {
        return dbSet.Where( predicate );
    }
    public void Add( T entity )
    {
        //entity.ObjectStateEnum = ObjectStateEnum.Added;
        dbSet.Add( entity );
    }
    public void Delete( dynamic id )
    {
        var entity = dbSet.Find(id);
        Delete( entity );
    }
    public void Update( T entity )
    {
        //entity.ObjectStateEnum = ObjectStateEnum.Modified;
        dbSet.Add( entity );
    }
}

and here is my UnitOfWork implementation. Again, the code fragments are just fragments. Not complete code.

    public class UnitOfWork : IUnitOfWorkAsync
{
    private IDataContextAsync context;
    private IOperationStatus opStatus;
    private Dictionary<string, dynamic> repositories;
    private ObjectContext objectContext;
    private DbTransaction transaction;
    private bool disposed;

    public IDataContextAsync DataContext { get { return context; } }

    //public UnitOfWork()
    //{
    //  context = new RedStoneDbContext(); //???? _context;
    //  opStatus = new OperationStatus(); //???? _opStatus;
    //  repositories = new Dictionary<string, dynamic>();
    //}
    public UnitOfWork( IDataContextAsync _context, IOperationStatus _opStatus )
    {
        context = _context;
        opStatus = _opStatus;
        repositories = new Dictionary<string, dynamic>();
    }

    public IOperationStatus SaveChanges()
    {
        opStatus.Success = false;
        try
        {
            int numRec = context.SaveChanges();
            opStatus.Success = true;
            opStatus.RecordsAffected = numRec;
        }
        catch ( SystemException ex )
        {
            opStatus = opStatus.CreateFromException( ex );
        }
        return opStatus;
    }
    public void Dispose()
    {
        Dispose( true );
        GC.SuppressFinalize( this );
    }

    public virtual void Dispose( bool disposing )
    {
        if ( disposed )
            return;

        if ( disposing )
        {
            try
            {
                if ( objectContext != null && objectContext.Connection.State == ConnectionState.Open )
                    objectContext.Connection.Close();
            }
            catch ( ObjectDisposedException )
            {
                // do nothing
            }
            if ( context != null )
            {
                context.Dispose();
                context = null;
            }
        }
        disposed = true;
    }
    public IRepository<T> Repository<T>() where T : class, IObjectState
    {
        return RepositoryAsync<T>();
    }

    public async Task<IOperationStatus> SaveChangesAsync()
    {
        opStatus.Success = false;
        try
        {
            int numRec = await context.SaveChangesAsync();
            opStatus.Success = true;
            opStatus.Message = "Record successfully saved!";
            opStatus.RecordsAffected = numRec;
        }
        catch ( DbUpdateConcurrencyException ex )
        {
            opStatus = opStatus.CreateFromException( ex );
        }
        catch ( SystemException ex )
        {
            opStatus = opStatus.CreateFromException( ex );
        }
        return opStatus;
    }
}

so, here is my question. When savechanges is called, I want to see if the entity contains a column "SocialSecurity" and if there is, I look at the user's role and permissions. If everything is OK, want to let incoming SSN to be persisted in the DB. If not, I just want SaveChanges to simply ignore SocialSecurity property but update everything else as usual. I can't figure out an easy and efficient way to do this. Any help is highly appreciated.

Babu.

Answer 1

You have all of the logical reasoning for the required actions here, it is just a matter of where you put the logic itself - and what you need to do.

You should have some sort of Service for each type that client code calls to retrieve data, be it related, filtered etc. Direct calls to the IQueryable of the database via the Repository should not be allowed - I can't tell from your code if you are implementing them or not.

If you have these Services, then you could directly check for permissions in any that have entites with SocialSecurity. Alternatively, you could create an Interface that defines SocialSecurity, and mark all entities with it appropriately. Either way, you can perform the role check when applicable.

If the role check fails, you will need to load the current entity from storage and either:

Replace the SocialSecurity property on the currently held entity with the one loaded from storage.

Or

Update all relevant properties in the newly loaded entity (except the SocialSecurity value)

Now you can perform the Update(entity).

There is no short way to do this, there is logic behind the Update operation and it needs to save directly (if permission is granted), or save while ensuring the current (from storage) SocialSecurity value is used instead of any changed one.

However, thinking about it, you could invert this, and not allow the user to edit the SocialSecurity value at all if they don't have permission when the page is loaded. It is usually bad practice to display data to, or give the impression of editing to, a user that does not have the permission to do so. This may be the better way to handle the problem.