RESTful是否限制每个经过身份验证的用户角色的资源的字段可见性？

我同意你的方法,响应过滤器可能是做到这一点的最佳解决方案; 并使用描述所需角色的属性简单地标记响应DTO.我还没有看到更好的方法来进行属性级权限.

从基于角色的响应中删除属性是完全可以接受的,如果它是公共API,则只需确保记录人们在每个角色中可以期待的属性.

AppHost中的响应过滤器:

this.ResponseFilters.Add((req, res, dto) => {

    // Get the roles you are permitted to access. You will need to store these in the request Items collection
    var roles = (from r in req.Items where r.Key == "Roles" select r.Value).FirstOrDefault() as string[];

    // Get the type of the response dto
    var dtoType = dto.GetType();

    // Loop through the properties
    foreach(var property in dtoType.GetPublicProperties()){

        // Ignore properties that are read-only
        if(!property.CanWrite)
            continue;

        // Get all the role attributes on the property
        var attributes = property.GetCustomAttributes(typeof(RequireRoleAttribute), false) as RequireRoleAttribute[];

        // Get all the permitted roles
        var permittedRoles = new List<string>();
        foreach(var attribute in attributes)
            permittedRoles.AddRange(attribute.Roles);

        // Check if there are specific permitted roles assigned to this attribute
        if(permittedRoles.Count != 0)
        {
            bool permitted = false;

            // Check if check require role against roles we may have.
            foreach(var role in permittedRoles){
                if(roles.Contains(role))
                {
                    // We have a matching role
                    permitted = true;
                    break;
                }
            }

            // No permission to the property
            if(!permitted) {
                var type = property.GetType();

                // Set the field to a default value.
                property.SetValue(dto, null);
            }
        }
    }
});

public class RequireRoleAttribute : Attribute
{
    public string[] Roles { get; set; }
    public RequireRoleAttribute(params string[] roles) { Roles = roles; }
}

[RequireRole("Spiderman","Superman","Batman")]
public string Address { get; set; }