thinktecture/Thinktecture.IdentityModel — pull request #43 by vegar (2014-07-02 20:36:33+00:00)
Title: Adding resources from route parameters

I really liked how the `ResourceAuthorize`-attribute helps with keeping the controller code free of authorization checks. Often, though, it's not enough to know what _type_ of resource you will access. You also need to know what instance of that resource that will be accessed.

In this cases, you would need to fall back to the `HttpRequestMessageExtensions.CheckAccessAsync( )` method, where you can supply additional resources bound to actual values.

In a WebApi, most of these values that you want as part of the authorization check is already present in the request, so why shouldn't the attribute pass them on?

Example:

```csharp
[HttpPost, Route("/api/{album}/tracks")]
[ResourceAuthorize("create", "track")]
public await Task AddTrack(int64 album, Track track)
{

}
````

Now, this will give two claims to the `IResourceAuthorizationManager`:

Actions: [ { 'name' : 'create' } ]
Resources: [ { 'name' : 'track' } ]

My goal is to change this into

Actions: [ { 'name' : 'create' } ]
Resources: [ { 'name : 'track' }, { 'album' : 'xxxxx' } ]

**note:** This is a re-submission of #40 after separating out the test project and tests for existing functionality into its own pull request (#42)
Its also worth noting that the changes done is only for the WebApi attribute. I have not looked into the MVC side yet.