Collection modification allowed when AllowNew and/or AllowNew are false

[hurcane]

Original discussion in #4846
Describe the bug
When editable list classes have AllowNew and/or AllowRemove false, the methods to modify the collection by clearing, adding, or removing items are still allowed. This has been validated against BusinessListBase and BusinessBindingListBase.

Version and Platform
CSLA version: 8.2.9 (discovered), 9.1.1 and 10.0.0 (validated to still exist)
OS: All
Platform: All

Code that Fails
This is a sample test that can be added to the CollectionsTest fixture. It fails on v.8.x, v9.x, and main when the test reaches the Assert.Fail() line. This test confirms the behavior on BusinessBindingListBase.

[TestMethod]
public void AllowNewFalse()
{
  TestCollection list = CreateTestCollection();
  list.AllowNew = false;
  Assert.IsFalse(list.AllowNew, "AllowNew should be false");
  try
  {
    list.AddNew();
    Assert.Fail("Should not be able to add new item");
  }
  catch (NotSupportedException)
  {
    // expected exception
  }
}

The use case for this scenario is a list of items that is built from an existing set of data, modifying the properties of the items, but not supporting adding or removing lines. Fixing this could be considered a breaking change.

[hurcane]

As I'm exploring this more, I am finding that authorization is not part of other methods that have available metadata. BusinessBase.Delete, for example, does not care about authorization.

[rockfordlhotka]

As I'm exploring this more, I am finding that authorization is not part of other methods that have available metadata. BusinessBase.Delete, for example, does not care about authorization.

That sounds like a whole different issue.