Simple Example Data Extender for implementing security on Tridion SmartTarget Promotion Management

SimpleSecurityExtender.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Xml;
using System.Xml.Linq;
using Tridion.Web.UI.Core.Extensibility;

namespace SmartTargetGUIExtensions
{
    public class SmartTargetSecurityExtender : DataExtender
    {
        public override string Name { get { return "SimpleSecurityExtender.SmartTargetSecurityExtender"; } }
        
        public override XmlTextReader ProcessRequest(XmlTextReader reader, PipelineContext context)
        {
            return reader;//Nothing to do on request
        }

        public override XmlTextReader ProcessResponse(XmlTextReader reader, PipelineContext context)
        {
            var command = context.Parameters["command"] as String;
            command = command.ToLower();
            if (command == "getpromotions" || command == "getregions")
            {
                List<String> data = new List<String>{"Sports"};//hardcoded for this example
                switch (command)
                {
                    case "getregions":
                        return FilterRegions(reader, context, data);
                    case "getpromotions" :
                        return FilterPromotions(reader, context, data);
                }
            }
            return reader;//default is to return unaltered XML
        }

        private XmlTextReader FilterRegions(XmlTextReader reader, PipelineContext context, List<String> allowedRegionPrefixes)
        {
            var listXml = XDocument.Load(reader);
            var regions = listXml.Root.Elements();
            var regionsToRemove = new List<XElement>();
            foreach (var region in regions)
            {
                bool regionOK = false;
                foreach (var prefix in allowedRegionPrefixes)
                {
                    if (region.Value.StartsWith(prefix))
                    {
                        regionOK = true;
                        break;
                    }
                }
                if (!regionOK)
                {
                    regionsToRemove.Add(region);
                }
            }
            foreach (var region in regionsToRemove)
            {
                region.Remove();
            }
            reader = new XmlTextReader(new StringReader(listXml.ToString()));
            reader.MoveToContent();
            return reader;
        }

        private XmlTextReader FilterPromotions(XmlTextReader reader, PipelineContext context, List<String> allowedRegionPrefixes)
        {
            var listXml = XDocument.Load(reader);
            var promos = listXml.Root.Elements();
            var promosToRemove = new List<XElement>();
            foreach (var promo in promos)
            {
                if (!AllowedRegion(promo.Element(promo.Name.Namespace + "Regions"), allowedRegionPrefixes))
                {
                    promosToRemove.Add(promo);
                }
            }
            foreach (var promo in promosToRemove)
            {
                promo.Remove();
            }
            reader = new XmlTextReader(new StringReader(listXml.ToString()));
            reader.MoveToContent();
            return reader;
        }

        private bool AllowedRegion(XElement regionsXml, List<string> allowedRegionPrefixes)
        {
            foreach (var regionName in regionsXml.Descendants(regionsXml.Name.Namespace + "Name").Select(n => n.Value))
            {
                foreach(var prefix in allowedRegionPrefixes)
                {
                    if (regionName.StartsWith(prefix))
                    {
                        return true;
                    }
                }
            }
            return false;           
        }
    }
}