Expert VB 2005 Business Objects Second Edition phần 9 pdf

A custom principal class to wrap the ASP.NET principal object would look like this: _ Public Class MembershipPrincipal Inherits Csla.Security.BusinessPrincipalBase Private mPrincipal As

Look back at Figures 10-6 and 10-7 to see the visual appearance of the pages Both Default.

aspx and ProjectEdit.aspx are content pages, adding their content to that already provided by

This is the area where content pages provide their content, and it is the main body of the page

You’ll see how each content page provides content for this area later in the chapter

Theme Support

ASP.NET 2.0 supports the concept of themes for a website, where the visual appearance of the site

is defined by a theme: a group of files in a theme-specific subdirectory beneath the App_Themes

directory in the virtual root A theme is a group of style sheets, graphics, and control skins thatdescribe the appearance of a site A given site can have many themes, and you can even allow theuser to choose between them if you so desire

Notice how all of the regions in the master page are set up using div tags No appearance acteristics are specified in the page itself Instead, the actual appearance is defined by a CSS stylesheet contained within the current theme for the site The PTWeb site includes and uses a Basictheme The use of the Basic theme is set up in web.config:

char-<pages theme="Basic" styleSheetTheme="Basic">

The theme property sets the default runtime theme, while styleSheetTheme sets the theme foruse at design time in Visual Studio The styleSheetTheme property should be removed when thewebsite is deployed to a production server

The files defining this theme are in the App_Themes/Basic folder beneath the virtual root Youshould notice that the names of the css and skin files match the name of the theme folder itself.Having the names match allows ASP.NET to automatically realize that it needs to use these fileswhen the theme is selected for the website The files in this theme are listed in Table 10-4

Table 10-4.Files in the Basic Theme

File Description

Basic.css The style sheet for the site

Basic.skin The skins for GridView, DetailsView, and Login controls

Images\background.jpg The background graphic for the header region

Images\corner.png The graphic for the rounded corner in the upper-left

Combined, these files define the look and feel of the site This includes defining the appearance

of the regions in MasterPage.master For instance, the header region is defined in the css file like this:

<asp:Login runat="server" BackColor="#DEDEDE" BorderColor="Black"

BorderStyle="Solid" BorderWidth="1px" Font-Names="Verdana"

By making the site theme-enabled, you can easily change the appearance of the site later

by creating a new theme directory and similar theme files, and setting the theme property in

web.config to use the new theme

Header Region

The header region of the page is the title area across the top It contains a single Label control

named PageTitle This control displays the title of the current content page, based on the Title

property set for that page The following code is included in MasterPage.master to load this value:

Protected Sub Page_Load( _

ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load PageTitle.Text = Page.Title

The navigation region displays the navigation links down the left side of each page To do this, a

web.sitemap file and associated SiteMapDataSource control are used to load the overall structure of

the site into memory This data is then data bound to a TreeView control for display to the user

The web.sitemap file is an XML file that contains a node for each page to be displayed in thenavigation region:

<?xml version="1.0" encoding="utf-8" ?>

<siteMap

xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >

<siteMapNode url="" title="" description="">

<siteMapNode url="~/Default.aspx" title="Home"

it really doesn’t represent a page and is just a placeholder If you were to define a hierarchical pagestructure, that node would typically point to Default.aspx.

Notice that MasterPage.master includes a SiteMapDataSource control:

<asp:SiteMapDataSource ID="SiteMapDataSource1" runat="server"

ShowStartingNode="False" />

This special data control automatically reads the data from the web.sitemap file and makes itavailable to controls on the page The ShowStartingNode property is set to False, indicating that theroot node in web.sitemap is to be ignored That’s perfect, because that node is empty and shouldn’t

be displayed

In this case, a TreeView control in the navigation region is bound to the SiteMapDataSource, so

it displays the items listed in web.sitemap to the user

LoginStatus Control

In the subnavigation region of MasterPage.master, you’ll see a LoginStatus control:

<asp:LoginStatus ID="LoginStatus1"

runat="server"/>

This is one of the login controls provided with ASP.NET 2.0, and its purpose is to allow the user

to log into and out of the site The control automatically displays the word Login if the user is loggedout, and Logout if the user is logged in When clicked, it also automatically redirects the user to alogin web page defined in web.config I’ll cover the web.config options later

Because the control automatically directs the user to the appropriate login page to be logged

in, no code is required for that process However, code is required to handle the case in which theuser clicks the control to be logged out This code goes in the master page:

Protected Sub LoginStatus1_LoggingOut( _

ByVal sender As Object, _ ByVal e As System.Web.UI.WebControls.LoginCancelEventArgs) _ Handles LoginStatus1.LoggingOut

ProjectTracker.Library.Security.PTPrincipal.Logout() Session("CslaPrincipal") = Csla.ApplicationContext.User System.Web.Security.FormsAuthentication.SignOut() End Sub

This code covers a lot of ground First, the Logout() method of PTPrincipal is called, which setsthe current principal on the current Thread object to an unauthenticated PTPrincipal object Thiswas discussed in Chapter 8 and used in PTWin in Chapter 9

However, when the user is logged in, their principal object is stored in a Session field so it can

be easily reloaded on every page request The details on how this works are discussed later in thechapter When the user logs out, that Session field is updated to reference the new principal object

■ Note If you want to avoid Session, you can choose to reload the user’s identity and roles from the securitydatabase on every page request While that avoids the use of Session, it can put a substantial workload on yoursecurity database server In PTWeb, I have opted to use Sessionto minimize the load on the database

The final step is to tell ASP.NET itself that the user is no longer authenticated This is done

by calling FormsAuthentication.SignOut() This method invalidates the security cookie used byASP.NET to indicate that the user has been authenticated The result is that ASP.NET sees the user

as unauthenticated on all subsequent page requests

This covers the logout process, but the login process requires some more work While theLoginStatus control handles the details of directing the user to a login page, that page must be

created

Login Page

Like the PTWin smart client, the PTWeb site is designed to use custom authentication, so I can

illus-trate the custom authentication support provided by CSLA NET I’ll also briefly discuss the use of

Windows integrated security and the ASP.NET membership service

In Web Forms, when using custom authentication, you need to configure the site appropriatelyusing web.config, and implement a login web page to collect and validate the user’s credentials

That’s the purpose behind Login.aspx

Forms-Based Authentication

When using forms-based authentication, users are often automatically redirected to a login form

before being allowed to access any other pages Alternatively, anonymous users can be allowed to

use the site, and they can choose to log into the site to gain access to extra features or functionality

The specific behaviors are defined by web.config

Before moving on, remember that the following implementation only works within IIS TheASP.NET Development Server provided with Visual Studio has various limitations; among them is

the inability to load custom security objects from assemblies in the Bin directory This means you

can’t use the ASP.NET Development Server to test or debug custom principal objects, custom

mem-bership providers, or other custom security objects if they’re in an assembly referenced from the

project

Though this is an unfortunate limitation, it can be argued that the ASP.NET DevelopmentServer is not intended for anything beyond hobbyist or casual usage, and that IIS should be used

for any serious business development

■ Note An alternative solution is to install the assembly containing your custom principal and identity classes into

the NET Global Assembly Cache (GAC) For PTWeb, this would mean giving ProjectTracker.Librarya strong

name and using the gacutil.execommand line utility to install the assembly into the GAC.ProjectTracker

Librarywould need to be updated in the GAC after each time you build the assembly I find that using IIS is a far

simpler solution than using the GAC

Configuring the Site

Using forms-based security in ASP.NET means that web.config includes elements like this:

unauthenti-■ Note To require users to log in before seeing any pages, replace <allow users="*"/>with

<deny users="?"/>

It is important that you also ensure that the security on the virtual root itself (within IIS) is figured to allow anonymous users If IIS blocks anonymous users, then it doesn’t really matter whatkind of security you use within ASP.NET

con-■ Note Remember that IIS security runs first, and then any ASP.NET security is applied.

With the web.config options shown previously, users can use the site without logging in, butthe concept of logging in is supported The goal is the same as with PTWin in Chapter 9: allow allusers to perform certain actions, and allow authenticated users to perform other actions based

Now this is where things get kind of cool There is no code behind Login.aspx This page uses

the ASP.NET Login control:

<asp:Login ID="Login1" runat="server">

</asp:Login>

This control is designed to automatically use the default ASP.NET membership provider for the site

■ Caution The user’s credentials flow from the browser to the web server in clear text—they are not

automati-cally encrypted Due to this, it is recommended that Login.aspxbe accessed over an SSL (Secure Sockets Layer)

connection so that data traveling to and from the browser is encrypted during the login process

You can write code to handle the events of the Login control if you desire, but a membership

provider offers a cleaner solution overall Of course, the membership provider that comes with

ASP.NET doesn’t understand PTPrincipal and PTIdentity objects, so PTWeb includes its own custom

membership provider

Custom Membership Provider

A membership provider is an object that inherits from System.Web.Security.MembershipProvider

to handle all aspects of membership These aspects include:

• Validating user credentials

• Adding a new user

bilities, you should create your own security library with appropriate objects

But PTPrincipal does understand how to validate a user’s credentials Fortunately, it is

pos-sible to implement a subset of the complete membership provider functionality, and that’s what

I do in PTWeb

The PTMembershipProvider class is in the App_Code directory, so ASP.NET automatically piles it and makes it available to the website This class inherits from MembershipProvider and

com-overrides the ValidateUser() method:

Public Class PTMembershipProvider

Inherits MembershipProvider

Public Overrides Function ValidateUser( _

ByVal username As String, ByVal password As String) As Boolean

If PTPrincipal.Login(username, password) Then System.Web.HttpContext.Current.Session("CslaPrincipal") = _ Csla.ApplicationContext.User

Return True

Else Return False End If

Remember from Chapter 8 that the Login() method sets the User property of Csla

ApplicationContext, thus automatically setting either the Thread object’s CurrentPrincipalproperty or the HttpContext.Current.User property to an authenticated PTPrincipal if the user’scredentials were valid; otherwise, it is set to an unauthenticated PTPrincipal Since this code will

be running within ASP.NET, it is the HttpContext value that is set to the user’s principal

The code then sets a Session field, CslaPrincipal, to contain this principal value so that it will be available to subsequent pages

Then the result value is returned The ASP.NET membership infrastructure relies on thisreturn value to know whether the user’s credentials were valid or not

Before this custom membership provider can be used, it must be defined in web.config as follows:

auto-Reloading the Principal

At this point, you’ve seen how the user can log in or out using the LoginStatus control on themaster page And you’ve seen how Login.aspx and the custom membership provider are used

to gather and validate the user’s credentials

But how does the principal object carry forward from page to page? Remember that the webtechnologies are stateless by default, and it is up to the web developer to manually implement statemanagement as she chooses Unfortunately, this extends to the user’s identity as well

The forms-based security infrastructure provided by ASP.NET writes an encrypted cookie tothe user’s browser That cookie contains a security ticket with a unique identifier for the user, the

user’s name, and an expiration time This cookie flows from the browser to the web server on each

page request, so that basic information is available

Notice, however, that the cookie doesn’t include the principal and identity objects That isbecause those objects could be quite large, and in some cases, might not even be serializable

Though PTPrincipal and PTIdentity are serializable, they could still be large enough to pose a

problem if you tried to write them to the cookie Cookies have a size limit, and remember that

PTIdentity contains an array with all the role names for the user Given a large number of roles

or lengthy role names, this could easily add up to a lot of bytes of data

■ Note It is possible to serialize the principal and identity objects into the cookie (if the objects are serializable)

Doing so isn’t recommended, however, due to the size limitations on cookies

It is quite possible to reload PTPrincipal and PTIdentity from the security database on everypage request Remember that the ASP.NET security cookie contains the username value, and you

already know that the user was authenticated All you would need is another stored procedure in

the database that returns the user information based on username alone; no password would be

provided or checked Similarly, another Shared method like Login() would be implemented in

PTPrincipal to load the objects based only on the username value

There are two drawbacks to this First, reloading this data from the security database on everypage request could cause a serious performance issue The security database could get overloaded

with all the requests Second, there’s an obvious security risk in implementing methods that allow

loading user identities without having to supply the password While that functionality wouldn’t be

exposed to the end user, it makes it easier for accidental bugs or malicious back-door code to creep

into your website

This is why I use Session to store the principal object in PTWeb The user’s credentials are dated, and the resulting principal object is placed in a Session field named CslaPrincipal On all

vali-subsequent page requests, this value is retrieved from Session and is used to set both the current

Thread and HttpContext object’s principals

The work occurs in Global.asax, as this file contains the event handlers for all events leading

up to a page being processed In this case, it is the AcquireRequestState event that is used:

Protected Sub Application_AcquireRequestState( _

ByVal sender As Object, ByVal e As System.EventArgs) Dim principal As System.Security.Principal.IPrincipal Try

principal = _ CType(Session("CslaPrincipal"), System.Security.Principal.IPrincipal) Catch

principal = Nothing End Try

If principal Is Nothing Then ' didn't get a principal from Session, so ' set it to an unauthenticted PTPrincipal ProjectTracker.Library.Security.PTPrincipal.Logout() Else

' use the principal from Session Csla.ApplicationContext.User = principal End If

End Sub

The reason for using the AcquireRequestState event, rather than the more obviousAuthenticateRequest event, is that Session isn’t initialized when AuthenticateRequest is raised, but it usually is initialized when AcquireRequestState is raised.

The code first attempts to retrieve the principal object from Session This can result in anexception if Session doesn’t exist, and so the value would end up being Nothing Also, if this is thefirst page request by the user, the Session field will return Nothing So the outcome is either a validPTPrincipal object or Nothing

If the resulting principal value is Nothing, PTPrincipal.Logout() is called to set the currentprincipal as an unauthenticated PTPrincipal, and the HttpContext is set to use that same principalobject This supports the idea of an unauthenticated anonymous guest user Both the web andbusiness library code have access to valid, if unauthenticated, principal objects, and can applyauthorization code as needed Additionally, by having the current principal be a valid PTPrincipalobject, a remote data portal can be invoked and the application server will impersonate the unau-thenticated user identity so that code can apply authorization rules as well.

On the other hand, if a principal object is retrieved from Session, then that value is set as thecurrent principal

Using Windows Integrated Security

If you wanted to use Windows integrated security, you wouldn’t need Login.aspx, the custom bership provider, or the code in Global.asax, because the user’s identity is already known The userprovided his Windows credentials to the browser, which in turn provided them to the web server.This means that the virtual root in IIS must be configured to disallow anonymous users, thusforcing the user to provide credentials to access the site It is IIS that authenticates the user andallows authenticated users into the site

mem-To have ASP.NET use the Windows identity from IIS, web.config must be configured correctly:

<authentication mode="Windows"/>

<identity impersonate="true"/>

The authentication mode is set to Windows, indicating that ASP.NET should defer all cation to the IIS host Setting the impersonate property to true tells ASP.NET to impersonate theuser authenticated by IIS

authenti-■ Note If you use Windows integrated security, and you are using a remote data portal, you must make sure to

change the application server configuration file to also use Windows security If the data portal is hosted in IIS, thevirtual root must be set to disallow anonymous access, thereby forcing the client to provide IIS with the Windowsidentity from the web server via integrated security

Using the ASP.NET Membership Service

ASP.NET 2.0 not only supports the broad concept of membership as used previously, but it provides

a complete membership service, including all the code to make it work

The membership service is most often used with the SQL membership provider that comeswith ASP.NET This provider requires that you use a predefined database schema, along with themembership objects provided by Microsoft to manage and interact with the database By default,ASP.NET will use a Microsoft SQL Server 2005 Express database in the virtual root’s App_Data direc-tory, but you can override that behavior to have it use another Microsoft SQL Server database ifneeded

The other membership provider shipped with ASP.NET is a connector to Active Directory (AD)

It does the same thing, but stores the user information in AD instead of a SQL database

Using the Membership Service with a Local Data Portal

If you are running the data portal in the client process, you can use the SQL membership provider

without any special effort In that case, the web server will interact directly with the database

Of course, you don’t need PTPrincipal or PTIdentity, because ASP.NET provides its own cipal and identity types Similarly, you don’t need to manually handle the logout event of the

prin-LoginStatus control or put any code in Global.asax

In short, it just works All the authorization code in CSLA NET will use the ASP.NET principalobject to call IsInRole(), so all the prebuilt authorization functionality just works

Using the Membership Service with a Remote Data Portal

Things are a bit more complex if you are using a remote data portal on an application server There

are two things to consider here First, the SQL membership provider talks directly to the security

database, knowing nothing about application servers If you want to use the application server, the

approach taken in PTWeb is better Second, the data portal will only accept principal objects that

inherit from Csla.Security.BusinessPrincipalBase, and of course the ASP.NET membership

prin-cipal types don’t do that

The first problem is one of application architecture, and you need to decide if it makes sensefor you to have the security mechanism talk directly to a database while your business code uses

an application server to talk to the business database

The second problem can be overcome with just a bit of code You need to wrap the ASP.NETmembership principal in a CSLA NET–style principal There are two parts to this First, you need

a custom principal class; second, you need to add some code to Global.asax

A custom principal class to wrap the ASP.NET principal object would look like this:

<Serializable()> _

Public Class MembershipPrincipal

Inherits Csla.Security.BusinessPrincipalBase

Private mPrincipal As System.Security.Principal.IPrincipal

Public Sub New(ByVal principal As System.Security.Principal.IPrincipal)

MyBase.New(principal.Identity)mPrincipal = principal

End Sub

Public Overrides Function IsInRole(ByVal role As String) As Boolean

Return mPrincipal.IsInRole(role)End Function

End Class

The code in Global.asax takes the ASP.NET principal and wraps it in a MembershipPrincipal:

Protected Sub Application_AcquireRequestState( _

ByVal sender As Object, ByVal e As System.EventArgs)Csla.ApplicationContext.User =

New MembershipPrincipal(HttpContext.Current.User)End Sub

This code sets the ApplicationContext object’s User property to use the newMembershipPrincipal This way, the original user information and list of roles are preserved, but

the actual principal object used by the application inherits from BusinessPrincipalBase The result

is that the data portal can impersonate the web user on the application server

At this point, you should have an understanding of how the website is organized It referencesProjectTracker.Library and uses a master page and theme to provide a consistent, manageableappearance for the site It also uses a mix of ASP.NET login controls and the prebuilt ProjectTrackersecurity objects to implement custom authentication.

Now let’s move on and discuss the pages that provide actual business behaviors

Business Functionality

With the common functionality in the master page, Login.aspx, and Global.asax covered, it ispossible to move on to the business functionality itself As I mentioned earlier, I’ll walk through the RolesEdit, ProjectList, and ProjectEdit web forms in some detail ResourceList and

ResourceEdit are available in the download and follow the same implementation approach.All of these web forms will be created using the new data binding capabilities built intoASP.NET 2.0 and the CslaDataSource control discussed in Chapter 5 These capabilities allow theweb developer to easily link controls on the form to business objects and their properties Thedeveloper productivity gained through this approach is simply amazing

Other key technologies I’ll be using are the MultiView control and the associated View control.These controls make it easy for a single page to present multiple views to the user, and are oftenvery valuable when building pages for editing data

Finally, remember that all these pages are content pages This means that they fit within thecontext of a master page—in this case, MasterPage.master As you’ll see, the tags in a content pageare a bit different from those in a simple web form

RolesEdit Form

The RolesEdit.aspx page is a content page, so its Page directive looks like this:

<%@ Page Language="VB" MasterPageFile="~/MasterPage.master"

AutoEventWireup="false" CodeFile="RolesEdit.aspx.vb"

Inherits="RolesEdit" title="Project Roles" %>

Notice the MasterPageFile property, which points to MasterPage.master Also notice the Titleproperty, which sets the page’s title It is this value that is used in the master page’s Load event han-dler to set the title text in the header region of the page

Figure 10-10 shows what the page looks like in Visual Studio

The grey Content title bar across the top of the main page body won’t be visible at runtime

It is visible at design time to remind you that you are editing a content area in the page If you look

at the page’s source, you’ll see that all the page content is contained within a Content control:

MultiView Control

The MultiView control contains two View controls, named MainView and InsertView Only one of

these views will be active (visible) at any time, so this form really defines two different views for the

user

Within your code, you select the view by setting the ActiveViewIndex property of the MultiViewcontrol to the numeric index of the appropriate View control Of course, using a numeric value like

this doesn’t lead to maintainable code, so within the page, I define an enumerated type with text

values corresponding to each View control:

Private Enum Views

MainView = 0 InsertView = 1 End Enum

The Views type will be used to change the page view as needed

Error Label

Beneath the MultiView control in Figure 10-10 is a Label control with its ForeColor set to Red The

purpose behind this control is to allow the page to display error text to the user in the case of an

exception

As you’ll see, the data access code uses Try Catch blocks to catch exceptions that occur ing any data updates (insert, update, or delete) The text of the exception is displayed in ErrorLabel

dur-so it is visible to the user

Figure 10-10.Layout of the RolesEdit page

Using a Business Object As a Data Source

In Chapter 5, I discussed the CslaDataSource control, and how it overcomes the limitations of thestandard ObjectDataSource control The RolesEdit page uses this control, making it relatively easy

to bind the Roles collection from ProjectTracker.Library to a GridView control on the page.The RolesDataSource data source control is defined on the page like this:

<csla:CslaDataSource ID="RolesDataSource" runat="server"

Of course, to get this data source control onto the web form, you can simply drag theCslaDataSource control from the toolbox onto the designer surface and set its properties throughthe Properties window in Visual Studio

Then, when the GridView and DetailsView controls are placed on the form, you can use theirpop-up Tasks menu to select the data source control, as shown in Figure 10-11

You can either write the tags yourself or use the designer support built into Visual Studio

Caching the Object in Session

To optimize the performance of the website, business objects are stored in Session While theycould be retrieved directly from the database when needed, storing them in Session reduces theload on the database server

To minimize the number of objects maintained in Session, all pages use the same Sessionfield to store their business objects: currentObject This way, only one business object is stored

in Session at any time, and that is the object being actively used by the current page

Of course, browsers have a Back button, which means that the user could navigate back tosome previous page that expects to be using a different type of object than the current page Forinstance, the user could be editing a Project object, and then start editing a Resource object.Session would have originally contained the Project, but then would contain the Resource

If the user then used the Back button to return to the ProjectEdit page, Session could stillhave the Resource object in the currentObject field This possibility is very real, and must be dealt

Figure 10-11.Choosing a data source for a GridView or DetailsView

with by checking the type of the object retrieved from Session to see if it is the type the page

actu-ally needs If not, then the correct object must be retrieved from the database

In RolesEdit, the GetRoles() method performs this task:

Private Function GetRoles() As ProjectTracker.Library.Admin.Roles

Dim businessObject As Object = Session("currentObject")

If businessObject Is Nothing OrElse _ Not TypeOf businessObject Is ProjectTracker.Library.Admin.Roles Then businessObject = _

ProjectTracker.Library.Admin.Roles.GetRoles Session("currentObject") = businessObject End If

Return CType(businessObject, ProjectTracker.Library.Admin.Roles) End Function

The code retrieves the currentObject item from Session If the result is Nothing, or if the ing object isn’t a Roles object, then a new Roles object is retrieved by calling the Roles.GetRoles()

result-factory method That newly retrieved object is placed in Session, making it the current object

In any case, a valid Roles object is returned as a result

Selecting an Object

The SelectObject event is raised when the web page needs data from the data source—the Roles

object, in this case The page must handle the event and return the requested data object:

Protected Sub RolesDataSource_SelectObject( _

ByVal sender As Object, ByVal e As Csla.Web.SelectObjectArgs) _ Handles RolesDataSource.SelectObject

Dim obj As ProjectTracker.Library.Admin.Roles = GetRoles() e.BusinessObject = obj

End Sub

The GetRoles() helper method is called to retrieve the Roles collection object Then the Rolesobject is returned to the RolesDataSource control by setting the e.BusinessObject property The

data source control then provides this object to the ASP.NET data binding infrastructure so it can be

used to populate any UI controls bound to the data control In this case, that’s the GridView control

in MainView That control is declared like this:

<asp:GridView ID="GridView1" runat="server"

The DataSourceID property establishes data binding to the RolesDataSource control

The DataKeyNames property specifies the name of the property on the business object that acts as a primary key for the object For a Role object, this is Id Remember the use of the

DataObjectField attribute on the Id property in Chapter 8, which provides a hint to Visual Studio

that this property is the object’s unique key value

The first two columns in the GridView control are bound to properties from the data source:

Id and Name, respectively The third column is a CommandField, which automatically adds Deleteand Edit links next to each element in the list The Delete link automatically triggers DeleteObject

to delete the specified object The Edit link puts the row into in-place edit mode, allowing theuser to edit the data in the selected row If the user accepts his updates, the UpdateObject event

is automatically raised No code beyond that handling those events is required to support either

of these links

Of course, you don’t have to deal with all these tags if you don’t want to Most of the code inthe CslaDataSource control exists to support the graphical designer support in Visual Studio Lookback at Figure 10-10 and notice how the GridView control displays the Id, Name, and commandcolumns I configured the control entirely using the Visual Studio designer and setting properties

on the controls

Figure 10-12 shows the Fields dialog for the GridView control

Notice that the Available fields box contains a list of the potentially bound fields from the datasource: Id and Name The CslaDataSource control’s designer support returns this list by using reflec-tion against the data source object as discussed in Chapter 5 You can use this dialog to choose whichcolumns are displayed, to control the way they are displayed, to rearrange their order, and more

Inserting an Object

The MainView contains not only a GridView control, but also a LinkButton control named

AddRoleButton This button allows the user to add a new Role object to the Roles collection

To do this, the current View is changed to InsertView:

Protected Sub AddRoleButton_Click( _

ByVal sender As Object, ByVal e As System.EventArgs) _ Handles AddRoleButton.Click

Figure 10-12.Fields dialog for a GridView control

Me.DetailsView1.DefaultMode = DetailsViewMode.Insert MultiView1.ActiveViewIndex = Views.InsertView End Sub

This changes the page to appear as shown in Figure 10-13

Look at the address bar in the browser; see how it is still RolesEdit.aspx even though thedisplay is entirely different from Figure 10-10 This illustrates the power of the MultiView control,

which allows a user to remain on a single page to view, edit, and insert data

The control shown here is a DetailsView control, which is data bound to the sameRolesDataSource control as the GridView earlier This control is declared in a manner very similar

columns are defined in a GridView

If the user enters values for a new role and clicks the Insert link in the DetailsView control, theInsertObject event is raised by RolesDataSource This event is handled in the page to add the new

role to the Roles collection:

Figure 10-13.The RolesEdit.aspx page when a new role is being added

Protected Sub RolesDataSource_InsertObject( _

ByVal sender As Object, ByVal e As Csla.Web.InsertObjectArgs) _ Handles RolesDataSource.InsertObject

Try Dim obj As Roles = GetRoles() Dim role As Role = obj.AddNew Csla.Data.DataMapper.Map(e.Values, role) Session("currentObject") = obj.Save e.RowsAffected = 1

Catch ex As Csla.DataPortalException Me.ErrorLabel.Text = ex.BusinessException.Message e.RowsAffected = 0

Catch ex As Exception Me.ErrorLabel.Text = ex.Message e.RowsAffected = 0

End Try End Sub

This code retrieves the current Roles object and then calls its AddNew() method to add a newchild Role object Recall that in Chapter 8 the AddNewCore() method was implemented to enableeasy adding of child objects to the collection The Public AddNew() method ultimately results in

a call to AddNewCore(), which adds an empty child object to the collection

This new child object is populated with data using the DataMapper object from Chapter 5:Csla.Data.DataMapper.Map(e.Values, role)

All new values entered by the user are provided to the event handler through e.Values TheMap() method uses reflection to copy those values to the corresponding properties on the object

If you want to avoid this use of reflection, you can replace this line with code like this:

role.Id = CInt(e.Values("Id"))role.Name = CStr(e.Values("Name"))For this simple object, this code isn’t too onerous, but for larger objects you could end upwriting a lot of code to copy each value into the object’s properties

Either way, once the data from e.Values has been put into the object’s properties, the object’sSave() method is called to update the database

■ Note This follows the typical web model of updating the database any time the user performs any action, andresults in a lot more database access than the equivalent Windows Forms implementation from Chapter 9 Youcould defer the call to Save()by putting a Save button on the form and having the user click that button tocommit all changes

Once the Save() method is complete, the resulting (updated) Roles object is put into Session

This is very important because the result of Save() is a new Roles object, and that new object must

be used in place of the previous one on subsequent pages For instance, the newly added role datagenerated a new timestamp value in the database, which can only be found in this new Roles object

This completes the insert operation, but the MultiView control is still set to display theInsertView It needs to be reset to display MainView That is done by handling the ItemInserted

event from the DetailsView control:

Protected Sub DetailsView1_ItemInserted( _

ByVal sender As Object, _ ByVal e As System.Web.UI.WebControls.DetailsViewInsertedEventArgs) _ Handles DetailsView1.ItemInserted

MultiView1.ActiveViewIndex = Views.MainView Me.GridView1.DataBind()

End Sub

The ActiveViewIndex is changed so that the MainView is displayed when the page refreshes

Also, the GridView control in MainView is told to refresh its data by calling its DataBind() method

Calling DataBind() causes the GridView to refresh its display so that it shows the newly addedRole object Behind the scenes, this triggers a call to RolesDataSource, causing it to raise its

SelectObject event

Figure 10-13 also shows a Cancel link If the user clicks that link, she likewise needs to be returned

to MainView When the user clicks Cancel, it triggers a ModeChanged event on the DetailsView control:

Protected Sub DetailsView1_ModeChanged( _

ByVal sender As Object, ByVal e As System.EventArgs) _ Handles DetailsView1.ModeChanged

MultiView1.ActiveViewIndex = Views.MainView End Sub

So, whether the user clicks Insert or Cancel, she ends up back at the main display of the list

of roles

Updating an Object

As shown in Figure 10-10, the CommandField column in the GridView control includes both Delete

and Edit links for each row I’ll get to the Delete link shortly, but for now let’s focus on the Edit link

When the user clicks the Edit link on a row, the GridView allows the user to edit that row’s data, as

shown in Figure 10-14

The user can edit the Name column only The Id column is set to read-only:

<asp:BoundField DataField="Id" HeaderText="Id"

ReadOnly="True" SortExpression="Id" />

When done, the user can click either the Update or Cancel links on the row If the user clicksUpdate, then the UpdateObject event is raised by RolesDataSource to trigger the data update Thisevent is handled in the page:

Protected Sub RolesDataSource_UpdateObject( _

ByVal sender As Object, ByVal e As Csla.Web.UpdateObjectArgs) _ Handles RolesDataSource.UpdateObject

Try Dim obj As Roles = GetRoles() Dim role As Role = obj.GetRoleById(CInt(e.Keys.Item("Id"))) role.Name = e.Values.Item("Name").ToString

Session("currentObject") = obj.Save e.RowsAffected = 1

Catch ex As Csla.DataPortalException Me.ErrorLabel.Text = ex.BusinessException.Message e.RowsAffected = 0

Catch ex As Exception Me.ErrorLabel.Text = ex.Message e.RowsAffected = 0

End Try End Sub

Figure 10-14.The RolesEdit.aspx page when a role is being edited

This code is quite similar to that for the insert operation discussed earlier, though in this case,the specific Role object that was edited is retrieved from the collection:

Dim role As Role = obj.GetRoleById(CInt(e.Keys.Item("Id")))e.Keys contains all the values from the page that correspond to the properties defined in theGridView control’s DataKeyNames property Recall that the only property set in DataKeyNames was Id,

so that’s the only value provided through e.Keys This value is passed to the GetRoleById() method

to retrieve the correct Role object

■ Note Update and delete operations require that appropriate business object property names be specified in

the GridViewor DetailsViewcontrol’s DataKeyNamesproperty

Since only one property can be edited, I opted not to use DataMapper and to set the propertyvalue manually However, in a more complex edit scenario in which many properties are edited,

you may choose to use DataMapper to simplify the code

Finally, the Roles object’s Save() method is called to commit the user’s changes to the base As with the insert process, the new Roles object returned from Save() is put into Session for

data-use on all subsequent page requests

Deleting an Object

Having seen how the update process works, you can probably guess how the delete process

works The user can click the Delete link next to a row in the GridView control When they do so,

RolesDataSource raises the DeleteObject event, which is handled in the page:

Protected Sub RolesDataSource_DeleteObject( _

ByVal sender As Object, ByVal e As Csla.Web.DeleteObjectArgs) _ Handles RolesDataSource.DeleteObject

Try Dim obj As Roles = GetRoles() Dim id As Integer = CInt(e.Keys.Item("Id")) obj.Remove(id)

Session("currentObject") = obj.Save e.RowsAffected = 1

Catch ex As Csla.DataPortalException Me.ErrorLabel.Text = ex.BusinessException.Message e.RowsAffected = 0

Catch ex As Exception Me.ErrorLabel.Text = ex.Message e.RowsAffected = 0

End Try End Sub

The Id value for the Role object to delete is retrieved from e.Keys and used to call the Remove()method on the Roles collection Recall from Chapter 8 that this overload of Remove() accepts the

Id value of the Role object

Of course, the child object is merely marked for deletion, and isn’t removed until the Save()method is called on the Roles object itself Again, the resulting Roles object returned from Save()

is put into Session for use on subsequent page requests

At this point, you should understand the basic process for creating a grid-based data form thatsupports viewing, inserting, editing and deleting data The only thing left to do in RolesEdit is toadd support for authorization.

Authorization

The RolesEdit authorization code is perhaps the simplest in the application If the user isn’t ized to edit the Roles object, then the CommandField column in the GridView control shouldn’t beshown; and if the user can’t add a new role, then the LinkButton for adding a new object shouldn’t

author-be shown

When the page is loaded, an ApplyAuthorizationRules() method is called:

Protected Sub Page_Load( _

ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

If Not IsPostBack Then ApplyAuthorizationRules() Else

Me.ErrorLabel.Text = ""

End If End Sub

Private Sub ApplyAuthorizationRules()

Me.GridView1.Columns( _ Me.GridView1.Columns.Count - 1).Visible = Roles.CanEditObject Me.AddRoleButton.Visible = Roles.CanAddObject

End Sub

The ApplyAuthorizationRules() method asks the Roles class whether the current user isauthorized to edit the object or add new roles If the user isn’t authorized, then the appropriatecontrols’ Visible properties are set to False, and the controls are thereby hidden

Since the user is then unable to put the GridView control into edit mode or ask it to delete anitem, the display effectively becomes read-only Similarly, without the LinkButton for adding a newitem, the user can’t switch the MultiView to InsertView; so again the page becomes a simple read-only page

As you can see, creating a simple grid-based edit page requires relatively little work You add

a data control, bind the GridView and possibly a DetailsView control to the data, and write a bit ofcode Most of the code in this page exists to react to user actions as they indicate that data is to beinserted, edited, or deleted

ProjectList Form

The ProjectList web form is responsible for displaying the list of projects to the user and allowingthe user to choose a specific project to view or edit From this page, the user can also delete a proj-ect and choose to add a new project Figure 10-15 shows the layout of ProjectList

It is important to realize that the GridView control actually has three columns: Id, Name, and the

CommandField column with the Delete links:

appear to the user as a hyperlink, though in reality it is more like a LinkButton—when the user

clicks a project name, a SelectedIndexChanged event is raised from the GridView control

Also of importance is the fact that the GridView control’s DataKeyNames property is set to Id, sothe Id property is specified as the unique identifier for each row of data Without setting this prop-

erty, the Delete link can’t work

The view, edit, and add operations are all handled by ProjectEdit, so ProjectList is really justresponsible for redirecting the user to that other page as appropriate The delete operation is han-

dled directly from ProjectList through a CommandField column in the GridView control

Notice that the GridView control displays paging links near the bottom This is because paging

is enabled for the control, as shown in Figure 10-16

Figure 10-15.Layout of ProjectList

You can also set the GridView control’s PageSize property to control how many items are shown

on each page All the paging work is done by the GridView control itself, which is fine because theProjectList business object will be maintained in Session, so the user can move from page to pagewithout hitting the database each time

Figure 10-17 shows the properties of the CslaDataSource control used on the page

Like the RolesDataSource control in RolesEdit, the TypeAssemblyName and TypeName propertiesare set to point to the appropriate class within ProjectTracker.Library This data source controlwill be used to retrieve the list of projects and to delete a project if the user clicks a Delete link

Loading the Data

When the GridView control needs data, it asks ProjectListDataSource for the data The data sourcecontrol in turn raises its SelectObject event, which is handled in the page:

Protected Sub ProjectListDataSource_SelectObject( _

ByVal sender As Object, ByVal e As Csla.Web.SelectObjectArgs) _ Handles ProjectListDataSource.SelectObject

e.BusinessObject = GetProjectList() End Sub

Figure 10-16.Enabling paging for the GridView control

Figure 10-17.Properties for the ProjectListDataSource control

As in RolesEdit, this page caches the business object in Session The details of that process arehandled by GetProjectList():

Private Function GetProjectList() As ProjectTracker.Library.ProjectList

Dim businessObject As Object = Session("currentObject")

If businessObject Is Nothing OrElse _ Not TypeOf businessObject Is ProjectList Then businessObject = ProjectTracker.Library.ProjectList.GetProjectList Session("currentObject") = businessObject

End If Return CType(businessObject, ProjectTracker.Library.ProjectList) End Function

This method is the same as the GetRoles() method discussed earlier, except that it ensures that a valid ProjectList object is returned instead of a Roles object

This code allows the GridView control to populate itself with pages of data for display asneeded

Viewing or Editing a Project

The Name column in the GridView control was set up as a HyperLinkField, meaning that the user sees

the values as a set of hyperlinks If the user clicks on one of the project names, the browser directly

navigates to the ProjectEdit.aspx page, passing the selected Id value as a parameter on the URL

Adding a Project

The ProjectList page contains a LinkButton to allow the user to add a new project If the user clicks

this button, a Click event is raised:

Protected Sub NewProjectButton_Click( _

ByVal sender As Object, ByVal e As System.EventArgs) _ Handles NewProjectButton.Click

'allow user to add a new project Response.Redirect("ProjectEdit.aspx") End Sub

The ProjectEdit page takes care of viewing, editing, and adding Project objects, so all thiscode does is redirect the user to ProjectEdit Notice that no parameter is provided to the page on

the URL, and this is what tells ProjectEdit to create a new Project rather than to view or edit an

existing one

Deleting a Project

The GridView control has a CommandField column, which automatically creates a Delete link for each

row of data If the user clicks a Delete link, the GridView deletes that row of data by calling its data

source control, ProjectListDataSource The result is a DeleteObject event handled in the page:

Protected Sub ProjectListDataSource_DeleteObject( _

ByVal sender As Object, ByVal e As Csla.Web.DeleteObjectArgs) _ Handles ProjectListDataSource.DeleteObject

Try ProjectTracker.Library.Project.DeleteProject( _ New Guid(e.Keys("Id").ToString))

e.RowsAffected = 1

Catch ex As Csla.DataPortalException Me.ErrorLabel.Text = ex.BusinessException.Message e.RowsAffected = 0

Catch ex As Exception Me.ErrorLabel.Text = ex.Message e.RowsAffected = 0

End Try End Sub

Again, the DataKeyNames property being set in the GridView means that the Id column valuefrom the row automatically flows into this event handler through e.Keys That value is converted

to a Guid object so that the Shared DeleteProject() method on the Project class can be called Theresult is immediate deletion of the related project data

Authorization

Having discussed all the core business functionality of the page, let’s look at the authorization code.Like in RolesEdit, the authorization rules themselves are in the business class, and the UI code sim-ply uses that information to enable and disable various UI controls as the page loads:

Protected Sub Page_Load( _

ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

If Not IsPostBack Then ApplyAuthorizationRules() Else

Me.ErrorLabel.Text = ""

End If End Sub

Private Sub ApplyAuthorizationRules()

Me.GridView1.Columns( _ Me.GridView1.Columns.Count - 1).Visible = _ Project.CanDeleteObject

NewProjectButton.Visible = _ ProjectTracker.Library.Project.CanAddObject End Sub

When the page is loaded, the ApplyAuthorizationRules() method makes sure that theCommandField column in the GridView is only visible if the user is authorized to delete Projectobjects It also hides the NewProjectButton control if the user isn’t allowed to add Project objects.The end result is that a user who can’t delete or add data is still allowed to view the list ofprojects, and they can even click on a project’s name to get more details in the ProjectEdit page

MainView includes a DetailsView control to allow display and editing of the Project object’sproperties This control is data bound to the ProjectDataSource control shown in Figure 10-20, and

so it is effectively data bound to the current Project object

The Id row is set to read-only, since the Project object’s Id property is a read-only property

The Description row is a TemplateField, which allows the use of a TextBox control with its TextMode

property set to MultiLine:

<asp:TextBox ID="TextBox1" TextMode="MultiLine"

ReadOnly="true" Width="100%" runat="server"

Text='<%# Bind("Description") %>'></asp:TextBox>

</ItemTemplate>

</asp:TemplateField>

Figure 10-18.Layout of MainView in ProjectEdit

Notice that even the ItemTemplate, which controls what is displayed in view mode, uses aTextBox control—but with its ReadOnly property set to true This allows the user to see the entiretext of the Description property, even if it is quite long.

Finally, the DetailsView control has a CommandField row, which allows the user to delete, edit,and add a Project

Beneath the DetailsView control is a GridView to list the resources assigned to the project.This control is data bound to the ResourcesDataSource control shown in Figure 10-20 It is effec-tively data bound to the Resources property of the current Project object; meaning that it is bound

to a collection of ProjectResource objects Remember that each type of business object must haveits own CslaDataSource control in order to act as a data source

The GridView control also has an ResourceId column, which is not visible Its DataKeyNamesproperty is set to ResourceId, specifying that the ResourceId column contains the unique identify-ing value for each row The Name and Assigned columns are read-only, while the Role column is

The GridView control also has a CommandField column so that the user can edit or removeassignments Of course, “remove” in this case really means unassign, but those details are handled

by the business object, not the UI

Finally, there’s a LinkButton to allow the user to assign a new resource to the project When theuser clicks that button, the view is switched so that the user see AssignView, where he or she canselect the resource to assign The layout of that view is shown in Figure 10-19

AssignView is comparatively straightforward It contains a GridView control that is databound to the ResourceListDataSource control Effectively, this means the GridView is bound to

a ResourceList business object, so it displays the list of resources to the user The CommandFieldcolumn in the GridView provides a Select link, so the user can select the resource to be assigned.There’s also a LinkButton at the bottom to allow the user to cancel the operation and return toMainView without assigning a resource at all

Finally, Figure 10-20 shows the bottom of the page, beneath the MultiView control

The CslaDataSource controls are used by the various DetailsView and GridView controls cussed previously And of course, the ErrorLabel control is a simple Label control that has its

dis-ForeColor property set to Red The exception-handling code in the form uses this control to display

details about any exceptions to the user

Now let’s go through the implementation of the page I’ll do this a bit differently than withthe previous pages, because by now you should understand how the pieces fit together using data

binding

Caching the Project Object in Session

The RolesEdit and ProjectList forms implement methods to retrieve the central business object

from Session, or to retrieve it from the database as necessary This not only implements a type of

cache to reduce load on the database, but it provides support for the browser’s Back button as well

The same thing is done in ProjectEdit:

Private Function GetProject() As Project

Dim businessObject As Object = Session("currentObject")

If businessObject Is Nothing OrElse _ Not TypeOf businessObject Is Project Then Try

Dim idString As String = Request.QueryString("id")

If Not String.IsNullOrEmpty(idString) Then Dim id As New Guid(idString)

businessObject = Project.GetProject(id) Figure 10-19.Layout of AssignView in ProjectEdit

Figure 10-20.Other controls in ProjectEdit

Else businessObject = Project.NewProject End If

Session("currentObject") = businessObject Catch ex As System.Security.SecurityException Response.Redirect("ProjectList.aspx") End Try

End If Return CType(businessObject, Project) End Function

As before, if there’s no object in Session, or if the object isn’t a Project, then a Project isretrieved from the database But the code here is a bit more complex than in the other forms.Notice that the Request.QueryString property is used to get the id value (if any) passed in onthe page’s URL If an id value is passed into the page, then that value is used to retrieve an existingProject:

Dim id As New Guid(idString)businessObject = Project.GetProject(id)Otherwise, a new Project is created for the page:

businessObject = Project.NewProjectEither way, the resulting object is placed into Session and is also returned as a result from themethod

It is possible for a user to navigate directly to ProjectEdit.aspx, providing no id value on theURL In such a case, the user might not be authorized to add a Project, and so a SecurityExceptionwould result In that case, the user is simply redirected to the ProjectList page, where he can safelyview the list of projects

Saving a Project

In this form, the Project object is saved in many scenarios, including:

• Inserting the project

• Editing the project

• Assigning a resource

• Unassigning a resource

• Deleting the project

To simplify the code overall, the SaveProject() method handles the common behaviors in allthose cases:

Private Function SaveProject(ByVal project As Project) As Integer

Dim rowsAffected As Integer Try

Session("currentObject") = project.Save() rowsAffected = 1

Catch ex As Csla.Validation.ValidationException Dim message As New System.Text.StringBuilder message.AppendFormat("{0}<br/>", ex.Message)

If project.BrokenRulesCollection.Count = 1 Then message.AppendFormat("* {0}: {1}", _

project.BrokenRulesCollection(0).Property, _ project.BrokenRulesCollection(0).Description) Else

For Each rule As Csla.Validation.BrokenRule In _ project.BrokenRulesCollection

message.AppendFormat( _

"* {0}: {1}<br/>", rule.Property, rule.Description) Next

End If Me.ErrorLabel.Text = message.ToString rowsAffected = 0

Catch ex As Csla.DataPortalException Me.ErrorLabel.Text = ex.BusinessException.Message rowsAffected = 0

Catch ex As Exception Me.ErrorLabel.Text = ex.Message rowsAffected = 0

End Try Return rowsAffected End Function

This method accepts the Project as a parameter and calls its Save() method As always, theresulting object is placed in Session to replace the old version of the object In case of an exception,

the ErrorLabel text is updated

The code here is the same as in the other pages, but it is worth consolidating in this page (and

in ResourceEdit) because of the many places the Project object is saved

ProjectDataSource

The ProjectDataSource control takes care of data binding that deals with the Project object

itself The page handles its DeleteObject, InsertObject, SelectObject, and UpdateObject events

For instance, the SelectObject handler looks like this:

Protected Sub ProjectDataSource_SelectObject( _

ByVal sender As Object, ByVal e As Csla.Web.SelectObjectArgs) _ Handles ProjectDataSource.SelectObject

e.BusinessObject = GetProject() End Sub

Thanks to the GetProject() method discussed earlier, this method is very simple to ment The delete, insert, and update events are also comparatively simple due to the SaveProject()

imple-method For instance, here’s the InsertObject event handler:

Protected Sub ProjectDataSource_InsertObject( _

ByVal sender As Object, ByVal e As Csla.Web.InsertObjectArgs) _ Handles ProjectDataSource.InsertObject

Dim obj As Project = GetProject() Csla.Data.DataMapper.Map(e.Values, obj, "Id") e.RowsAffected = SaveProject(obj)

End Sub

The current Project object is retrieved from Session (or pulled from the database), and thenew values entered by the user are mapped into the object’s properties using the DataMapper fromChapter 5 Then SaveProject() is called to save the project and update Session with the newlyupdated data.

The update operation works in a similar manner, so I won’t detail it here

Deleting the Project

DeleteObject is a bit different:

Protected Sub ProjectDataSource_DeleteObject( _

ByVal sender As Object, ByVal e As Csla.Web.DeleteObjectArgs) _ Handles ProjectDataSource.DeleteObject

Try Project.DeleteProject(New Guid(e.Keys("Id").ToString)) Session("currentObject") = Nothing

e.RowsAffected = 1 Catch ex As Csla.DataPortalException Me.ErrorLabel.Text = ex.BusinessException.Message e.RowsAffected = 0

Catch ex As Exception Me.ErrorLabel.Text = ex.Message e.RowsAffected = 0

End Try End Sub

If the user clicks the link in the DetailsView control to delete the project, the DeleteObjectevent is raised e.Keys contains the Id row value from the DetailsView, because the DataKeyNamesproperty on the control is set to Id This value is used to create a Guid, which is then passed to theShared DeleteProject() method to delete the project Of course, this immediately deletes theProject using the data portal, and so proper exception handling is implemented to display anyexception messages in ErrorLabel

Once the Project has been deleted, it makes no sense to leave the user on ProjectEdit If thedelete operation is successful, the DetailsView control raises an ItemDeleted event:

Protected Sub DetailsView1_ItemDeleted( _

ByVal sender As Object, _ ByVal e As System.Web.UI.WebControls.DetailsViewDeletedEventArgs) _ Handles DetailsView1.ItemDeleted

Response.Redirect("ProjectList.aspx") End Sub

The user is simply redirected to ProjectList, where she should no longer see the deletedproject in the list

ResourcesDataSource

The ResourcesDataSource control takes care of data binding dealing with the Resources collectionfrom the Project object The GridView control in MainView is bound to this control, and the pagehandles its DeleteObject, SelectObject, and UpdateObject events

There’s no need to handle the InsertObject event, because the GridView isn’t used to cally add ProjectResource objects to the collection I’ll discuss adding a new child object shortly.

dynami-The SelectObject event handler returns the collection of ProjectResource objects for theProject:

Protected Sub ResourcesDataSource_SelectObject( _

ByVal sender As Object, ByVal e As Csla.Web.SelectObjectArgs) _ Handles ResourcesDataSource.SelectObject

Dim obj As Project = GetProject() e.BusinessObject = obj.Resources End Sub

It first gets the current Project object by calling GetProject() Then it simply provides theResources collection to the data source control, which in turn provides it to any UI controls

requiring the data

The DeleteObject and UpdateObject event handlers are worth exploring a bit The DeleteObjecthandler gets the ResourceId value from the GridView control through e.Keys and uses that value to

remove the ProjectResource object from the collection:

Protected Sub ResourcesDataSource_DeleteObject( _

ByVal sender As Object, ByVal e As Csla.Web.DeleteObjectArgs) _ Handles ResourcesDataSource.DeleteObject

Dim obj As Project = GetProject() Dim rid As Integer = CInt(e.Keys("ResourceId")) obj.Resources.Remove(rid)

e.RowsAffected = SaveProject(obj) End Sub

The current Project object is retrieved, and then the Remove() method is called on theResources collection to remove the specified child object SaveProject() is then called to commit

the change

UpdateObject is a bit more complex:

Protected Sub ResourcesDataSource_UpdateObject( _

ByVal sender As Object, ByVal e As Csla.Web.UpdateObjectArgs) _ Handles ResourcesDataSource.UpdateObject

Dim obj As Project = GetProject() Dim rid As Integer = CInt(e.Keys("ResourceId")) Dim res As ProjectResource = obj.Resources.GetItem(rid) Csla.Data.DataMapper.Map(e.Values, res)

e.RowsAffected = SaveProject(obj) End Sub

In this case, the actual child object is retrieved from the Resources collection Then the valuesentered into the GridView by the user are pulled from e.Values and are mapped into the child object

using DataMapper And finally, SaveProject() is called to commit the changes

Assigning a Resource to the Project

The GridView isn’t used to insert new ProjectResource child objects, so ResourcesDataSource will

never raise its InsertObject method Users are allowed to assign a new user to the project by

click-ing a LinkButton control In that case, the MultiView is changed to display AssignView so that the

user can select the resource to be assigned:

Protected Sub AddResourceButton_Click( _

ByVal sender As Object, ByVal e As System.EventArgs) _ Handles AddResourceButton.Click

Me.MultiView1.ActiveViewIndex = Views.AssignView End Sub

Once AssignView is displayed, the user can either select a resource or click the Cancel button

If the user selects a resource, the resource is assigned to the project:

Protected Sub GridView2_SelectedIndexChanged( _

ByVal sender As Object, ByVal e As System.EventArgs) _ Handles GridView2.SelectedIndexChanged

Dim obj As Project = GetProject() Try

obj.Resources.Assign(CInt(Me.GridView2.SelectedDataKey.Value))

If SaveProject(obj) > 0 Then Me.GridView1.DataBind() Me.MultiView1.ActiveViewIndex = Views.MainView End If

Catch ex As InvalidOperationException ErrorLabel.Text = ex.Message End Try

DataBind() to force this refresh to occur

Several things could go wrong during this whole process The resource might already beassigned, or the SaveProject() method could fail due to some data error Of course, SaveProject()already does its own exception handling and displays any exception messages to the user throughthe ErrorLabel control

But if the user attempts to assign a duplicate resource to the project, the Assign() method willraise an InvalidOperationException This is caught and the message text is displayed to the user

Notice that in that case, the user is not sent back to MainView, but remains on AssignView so that

the user can choose a different resource to assign if desired

The simplest course of action occurs if the user clicks the Cancel LinkButton control:

Protected Sub CancelAssignButton_Click( _

ByVal sender As Object, ByVal e As System.EventArgs) _ Handles CancelAssignButton.Click

Me.MultiView1.ActiveViewIndex = Views.MainView End Sub

In that case, the user is simply directed back to the MainView display