Implementing Security - ASP.NET Dynamic Data - page 475

IQueryable object created by the data source control as well as replace it with a new one
you create. The following code snippet shows how to take advantage of the event argu-
ment, call the new GetQueryable method defined by the UnleashedMetaModel , and replace
the original query object with the one it returns.
public partial class List : Page
{
protected UnleashedMetaTable table;
// ...
protected void DataSource_QueryCreated(
object sender, QueryCreatedEventArgs e)
{
e.Query = this.table.GetQueryable(e.Query);
}
}
Figure 14.9 shows the Orders list page after making this change. You can tell that the page
only shows the current user's own orders by looking at the Ship Name column, which
displays the name of her company, Alfreds Futterkiste , which is also the only customer
shown in the Customer filter drop-down.
FIGURE 14.9 Orders List Page with row-level security applied.
To finish implementing the row-level security for read access, you need to implement a
similar change in the Edit, Delete, and Details page templates. The process is identical—
create a QueryCreated event handler for the EntityDataSource control and have it call