Optimizely表单网格块特殊属性验证：限制Everyone组选删除权限

现有代码结构 #

Form Grid Block属性定义 #

[Display(Name = "表单访问组", Description = "表单访问组", GroupName = SystemTabNames.Content, Order = 400)]
[EditorDescriptor(EditorDescriptorType = typeof(CollectionEditorDescriptor<FormActionsAccess>))]
public virtual IList<FormActionsAccess> OptimizelyFormActionsAccess { get; set; }

特殊属性类FormActionsAccess定义 #

public class FormActionsAccess
{
    [Display(Name = "Okta组", Description = "Okta组", Order = 100)]
    [SelectOne(SelectionFactoryType = typeof(OktaGroupSelectionFactory))]
    public virtual string OktaGroup { get; set; }

    [Display(Name = "表单操作权限", Description = "表单操作权限", Order = 200)]
    [SelectMany(SelectionFactoryType = typeof(FormSubmissionDataActionSelectionFactory))]
    [RestrictDeleteOption(nameof(OktaGroup), "Everyone")]
    public virtual string FormOperationAccess { get; set; }
}

核心需求 #

当OktaGroup选中“Everyone”时，FormOperationAccess禁止选择“delete”操作权限。

实现方案 #

1. 客户端动态禁用（提升用户体验） #

通过自定义EditorDescriptor结合客户端脚本，监听OktaGroup选择变化，动态控制FormOperationAccess的选项可用性：

步骤1：创建自定义EditorDescriptor

[EditorDescriptorRegistration(TargetType = typeof(IList<FormActionsAccess>))]
public class CustomFormActionsAccessEditorDescriptor : CollectionEditorDescriptor<FormActionsAccess>
{
    public override void ModifyMetadata(ExtendedMetadata metadata, IEnumerable<Attribute> attributes)
    {
        base.ModifyMetadata(metadata, attributes);
        metadata.ClientEditingClass = "custom/FormActionsAccessEditor";
    }
}

步骤2：编写客户端脚本（custom/FormActionsAccessEditor.js）

define([
    "dojo/_base/declare",
    "epi-cms/contentediting/editors/CollectionEditor"
], function (declare, CollectionEditor) {
    return declare([CollectionEditor], {
        _createItemEditor: function (item, index) {
            var editor = this.inherited(arguments);
            
            // 获取对应控件
            var oktaGroupSelect = editor.containerNode.querySelector('[data-property-name="OktaGroup"] select');
            var operationSelect = editor.containerNode.querySelector('[data-property-name="FormOperationAccess"] select');
            
            // 定义权限控制逻辑
            var toggleDeleteOption = function() {
                var isEveryoneSelected = oktaGroupSelect.value === "Everyone";
                var deleteOption = operationSelect.querySelector('option[value="delete"]');
                if (deleteOption) {
                    deleteOption.disabled = isEveryoneSelected;
                    // 若已选中delete且当前为Everyone，自动取消选中
                    if (isEveryoneSelected && deleteOption.selected) {
                        deleteOption.selected = false;
                        operationSelect.dispatchEvent(new Event('change'));
                    }
                }
            };
            
            // 初始化执行+监听变化
            toggleDeleteOption();
            oktaGroupSelect.addEventListener('change', toggleDeleteOption);
            
            return editor;
        }
    });
});

2. 服务端验证（确保数据合法性） #

添加自定义验证属性，在保存时强制校验，防止绕过客户端验证的非法数据：

步骤1：创建自定义验证属性

public class RestrictDeleteForEveryoneAttribute : ValidationAttribute
{
    protected override ValidationResult IsValid(object value, ValidationContext validationContext)
    {
        var formActionsAccess = validationContext.ObjectInstance as FormActionsAccess;
        if (formActionsAccess == null) return ValidationResult.Success;
        
        if (formActionsAccess.OktaGroup == "Everyone" && !string.IsNullOrEmpty(formActionsAccess.FormOperationAccess))
        {
            var selectedOperations = formActionsAccess.FormOperationAccess.Split(',', StringSplitOptions.RemoveEmptyEntries);
            if (selectedOperations.Contains("delete", StringComparer.OrdinalIgnoreCase))
            {
                return new ValidationResult("当选择\"Everyone\"组时，不可授予\"delete\"操作权限");
            }
        }
        
        return ValidationResult.Success;
    }
}

步骤2：绑定验证属性到类

[RestrictDeleteForEveryone]
public class FormActionsAccess
{
    // 原有属性定义保持不变
}

内容的提问来源于stack exchange，提问作者user21538182