CanWriteProperty doesn't take into account if the property's value is changing

[tdyocum]

I have some logic around whether or not a property is editable in the CanWriteProperty method override. This is based on other readonly properties on my object. The problem I having is that the CanWriteProperty method is being fired when I attempt to set the property to same value, from an API method. Within my Edit method, I take a model from the caller, I get the Customer object from the datastore, and then I set each editable property from the model that's passed in. So, in my case the value of this property hasn't changed, but the CanWriteProperty is still firing off the Csla.Security.SecurityException.

While I can add in a check in the property to see if the value is different from the current value of my property, it just seems like a bug that the CanWriteProperty doesn't take into account whether or not the property value has changed.

Not sure if that makes sense, but wanted to see if this is a bug in the framework?

[rockfordlhotka]

CanWriteProperty merely checks to see if the current user could write to the property. It doesn't know the old or new values, because it can be called at any time to get the answer - and is often called when the property isn't be changed at all.

In most of my UIs, for example, I call it a lot as the page/form loads so I can disable or change which controls are rendered so the user has an obvious signal that the property can't be changed (by them).

What you are describing, I think, is the need for a custom authorization rule that takes into account the other property values. That's exactly the purpose behind custom authorization rules. Using that technique you shouldn't have to do any special code at all, because the behaviors should work as expected.

In short, overriding CanWriteProperty isn't something that should normally occur, because the rules engine should provide a better solution.

[hurcane]

This is 1.5 years after the original post, but I recently had to deal with a similar situation. I was working on an OData API that uses editable business objects in the data modification methods (i.e. Post, Put, and Patch). I got tired of repeatedly writing checks that the value changed, so we added the following method to our custom BusinessBase subclass:

public bool TrySetPropertyValue(string propertyName, object value)
{
    IPropertyInfo pi = FieldManager.GetRegisteredProperties()
        .Where(p => p.Name == propertyName).FirstOrDefault();
    if (pi == null) return false;

    /* 
     * Result is true if the values match. Some fields may not have a field value set, which
     * means the property assumes the default value.
     */
    var fieldValue = FieldManager.GetFieldData(pi)?.Value ?? pi.DefaultValue;
    if (fieldValue is SmartDate fieldDate)
    {
        SmartDate valueDate = new SmartDate(value.ToString(), fieldDate.EmptyIsMin);
        if (fieldDate == valueDate) return true;
    }
    else
    {
        if (object.Equals(fieldValue, value)) return true;
    }

    // Check for necessary access via auth rules.
    if (!CanWriteProperty(propertyName)) return false;

    // Use reflection to check for public access and set the value.
    var piReflected = pi.GetPropertyInfo();
    if (piReflected?.GetSetMethod() == null) return false;
    piReflected.SetValue(this, value);
    return true;
}

This simplified our Dto -> BusinessBase mapping code to this style:
if (!bizObj.TrySetPropertyValue(propertyName, dtoValue) RecordError(....);