thinktecture/Thinktecture.IdentityModel — pull request #40 by vegar (2014-06-25 10:27:49+00:00)
Title: Resource values from request

I really liked how the `ResourceAuthorize`-attribute helps with keeping the controller code free of authorization checks. Often, though, it's not enough to know what _type_ of resource you will access. You also need to know what instance of that resource that will be accessed.

In this cases, you would need to fall back to the `HttpRequestMessageExtensions.CheckAccessAsync( )` method, where you can supply additional resources bound to actual values.

In a WebApi, most of these values that you want as part of the authorization check is already present in the request, so why shouldn't the attribute pass them on?

Example:

[HttpPost, Route("/api/{album}/tracks")]
[ResourceAuthorize("create", "track")]
public await Task AddTrack(int64 album, Track track)
{

}

Now, this will give two claims to the `IResourceAuthorizationManager`:

Actions: [ { 'name' : 'create' } ]
Resources: [ { 'name' : 'track' } ]

My goal is to change this into

Actions: [ { 'name' : 'create' } ]
Resources: [ { 'name : 'track' }, { 'album' : 'xxxxx' } ]