I am building a Sitecore 8.1 / Solr 4.10 site. I want to be able to do a general site content query through the web database and only return content items that the current user has permissions to view. To me this seems like a simple request and should be a no-brainer. However we never figured this out properly. So we built what seems like a convoluted solution where we have 2 different custom fields in our Solr index - one called read_roles that is a list of all of the roles that have read access to the indexed item. And another called denied_roles that is a list of all of the roles that do not have read access to the indexed item. Then in our search method we apply a security filter using the following code:
public static IQueryable<T> ApplySecurityFilter<T>(this IQueryable<T> query) where T : SearchResultItem {
var userRoles = Sitecore.Context.User.Roles.Select(r => r.Name);
var readPredicate = PredicateBuilder.False<T>();
readPredicate = userRoles.Aggregate(readPredicate, (current, role) => current.Or(i => i["read_roles"].Equals(role)));
var denyPredicate = PredicateBuilder.True<T>();
denyPredicate = userRoles.Aggregate(denyPredicate, (current, role) => current.And(i => !i["denied_roles"].Equals(role)));
if (readPredicate.Body.NodeType != System.Linq.Expressions.ExpressionType.Constant) {
query = query.Filter(readPredicate);
}
if (readPredicate.Body.NodeType != System.Linq.Expressions.ExpressionType.Constant) {
query = query.Filter(denyPredicate);
}
return query;
}
This seemed to work in Sitecore v7.5 but now I am having trouble in Sitecore 8.1. Is there some simpler way of restricting the results in a Solr query to only be items that the current user has read access to?
Corey