How to handle authorization with Breeze JS?

Question

Currently my app looks at router parameter and logged in user (Principal.Identity) to authorize access to certain resources (e.g: Add student to your class [identity + class

Answer 1

Breeze can have as many 'save' endpoints as you want. For example, a hypothetical server implementation might be

[BreezeController]
public class MyController : ApiController {

  [HttpPost]
  [Authorize(...)]
  public SaveResult SaveCustomersAndOrders(JObject saveBundle) {
    // CheckCustomersAndOrders would be a custom method that validates your data 
    ContextProvider.BeforeSaveEntitiesDelegate = CheckCustomerAndOrders;
    return ContextProvider.SaveChanges(saveBundle);
  }

  [HttpPost]
  [Authorize]
  public SaveResult SaveSuppliersAndProducts(JObject saveBundle) {
     ...
  }

You would call these endpoints like this

var so = new SaveOptions({ resourceName: "SaveWithFreight2", tag: "freight update" });

   myEntityManager.saveChanges(customerAndOrderEntities, { 
     resourceName: "SaveCustomersAndOrder" }
   ).then(...)

or

   myEntityManager.saveChanges(supplierAndProductEntities, { 
     resourceName: "SaveSuppliersAndProducts" }
   ).then(...)

Authorization is mediated via the [Authorize] attribute on each of the [HttpPost] methods. You can read more about the [Authorize] attribute here: http://sixgun.wordpress.com/2012/02/29/asp-net-web-api-basic-authentication/