Creating a Private Custom Dashboard in C# with DevExpress MVC

MeridianDashboards/
|-- Controllers/
|   |-- DashboardController.cs        // Main dashboard CRUD + sharing
|   |-- AccountController.cs          // Login, roles, permissions
|   |-- AdminController.cs            // Data source management
|
|-- Models/
|   |-- Dashboard.cs                  // Dashboard entity (owner, name, xml)
|   |-- DashboardShare.cs             // Share record (dashboardId, userId, permission)
|   |-- DataSourcePermission.cs       // Which roles can access which data
|   |-- AppUser.cs                    // User with role
|
|-- Services/
|   |-- CustomDashboardStorage.cs     // Implements IDashboardStorage
|   |-- CustomDataSourceStorage.cs    // Controls data source access per user
|   |-- DashboardSharingService.cs    // Share, revoke, list shared dashboards
|
|-- Views/
|   |-- Dashboard/
|   |   |-- Index.cshtml              // "My Dashboards" list
|   |   |-- Designer.cshtml           // Dashboard designer (create/edit)
|   |   |-- Viewer.cshtml             // View-only dashboard
|   |   |-- SharedWithMe.cshtml       // Dashboards others shared with me
|   |
|   |-- Admin/
|       |-- DataSources.cshtml        // Manage data connections
|       |-- Users.cshtml              // Manage users and roles
|
|-- App_Start/
    |-- DashboardConfig.cs            // Register dashboard routes and storage

public class Dashboard
{
    public int Id { get; set; }
    public string Name { get; set; }
    public string Description { get; set; }

    // The DevExpress dashboard XML definition
    public string DashboardXml { get; set; }

    // Ownership
    public int OwnerId { get; set; }
    public virtual AppUser Owner { get; set; }

    // Metadata
    public DateTime CreatedAt { get; set; }
    public DateTime ModifiedAt { get; set; }
    public bool IsArchived { get; set; }

    // Navigation
    public virtual ICollection<DashboardShare> Shares { get; set; }
}

public class DashboardShare
{
    public int Id { get; set; }
    public int DashboardId { get; set; }
    public int SharedWithUserId { get; set; }

    // "View" or "Edit"
    public string Permission { get; set; }

    public DateTime SharedAt { get; set; }
    public int SharedByUserId { get; set; }

    // Navigation
    public virtual Dashboard Dashboard { get; set; }
    public virtual AppUser SharedWithUser { get; set; }
    public virtual AppUser SharedByUser { get; set; }
}

public class DataSourcePermission
{
    public int Id { get; set; }
    public string DataSourceName { get; set; }  // "Sales", "Finance", etc.
    public string Role { get; set; }            // "SalesDirector", "CEO", etc.
    public bool CanAccess { get; set; }
}

public class CustomDashboardStorage : IDashboardStorage
{
    private readonly AppDbContext _db;
    private readonly int _currentUserId;

    public CustomDashboardStorage(AppDbContext db, int currentUserId)
    {
        _db = db;
        _currentUserId = currentUserId;
    }

    // Returns only dashboards the current user owns or has been shared
    public IEnumerable<DashboardInfo> GetAvailableDashboardsInfo()
    {
        var owned = _db.Dashboards
            .Where(d => d.OwnerId == _currentUserId && !d.IsArchived)
            .Select(d => new DashboardInfo
            {
                ID = d.Id.ToString(),
                Name = d.Name
            });

        var shared = _db.DashboardShares
            .Where(s => s.SharedWithUserId == _currentUserId)
            .Select(s => new DashboardInfo
            {
                ID = s.Dashboard.Id.ToString(),
                Name = s.Dashboard.Name + " (shared)"
            });

        return owned.Concat(shared).ToList();
    }

    // Load dashboard XML - only if user has access
    public XDocument LoadDashboard(string dashboardId)
    {
        int id = int.Parse(dashboardId);
        var dashboard = _db.Dashboards.Find(id);

        if (dashboard == null)
            throw new InvalidOperationException("Dashboard not found.");

        if (!UserCanAccess(id))
            throw new UnauthorizedAccessException("Access denied.");

        return XDocument.Parse(dashboard.DashboardXml);
    }

    // Save - only owner or users with Edit permission
    public void SaveDashboard(string dashboardId, XDocument document)
    {
        int id = int.Parse(dashboardId);

        if (!UserCanEdit(id))
            throw new UnauthorizedAccessException("Edit access denied.");

        var dashboard = _db.Dashboards.Find(id);
        dashboard.DashboardXml = document.ToString();
        dashboard.ModifiedAt = DateTime.UtcNow;
        _db.SaveChanges();
    }

    private bool UserCanAccess(int dashboardId)
    {
        return _db.Dashboards.Any(d => d.Id == dashboardId
                   && d.OwnerId == _currentUserId)
            || _db.DashboardShares.Any(s => s.DashboardId == dashboardId
                   && s.SharedWithUserId == _currentUserId);
    }

    private bool UserCanEdit(int dashboardId)
    {
        return _db.Dashboards.Any(d => d.Id == dashboardId
                   && d.OwnerId == _currentUserId)
            || _db.DashboardShares.Any(s => s.DashboardId == dashboardId
                   && s.SharedWithUserId == _currentUserId
                   && s.Permission == "Edit");
    }
}

public class DashboardSharingService
{
    private readonly AppDbContext _db;

    public DashboardSharingService(AppDbContext db)
    {
        _db = db;
    }

    public void ShareDashboard(int dashboardId, int ownerUserId,
        int targetUserId, string permission)
    {
        // Only the owner can share
        var dashboard = _db.Dashboards.Find(dashboardId);
        if (dashboard.OwnerId != ownerUserId)
            throw new UnauthorizedAccessException("Only the owner can share.");

        // Prevent duplicate shares
        var existing = _db.DashboardShares
            .FirstOrDefault(s => s.DashboardId == dashboardId
                && s.SharedWithUserId == targetUserId);

        if (existing != null)
        {
            existing.Permission = permission;  // Update permission level
        }
        else
        {
            _db.DashboardShares.Add(new DashboardShare
            {
                DashboardId = dashboardId,
                SharedWithUserId = targetUserId,
                SharedByUserId = ownerUserId,
                Permission = permission,  // "View" or "Edit"
                SharedAt = DateTime.UtcNow
            });
        }

        _db.SaveChanges();
    }

    public void RevokeDashboardAccess(int dashboardId,
        int ownerUserId, int targetUserId)
    {
        var dashboard = _db.Dashboards.Find(dashboardId);
        if (dashboard.OwnerId != ownerUserId)
            throw new UnauthorizedAccessException("Only the owner can revoke.");

        var share = _db.DashboardShares
            .FirstOrDefault(s => s.DashboardId == dashboardId
                && s.SharedWithUserId == targetUserId);

        if (share != null)
        {
            _db.DashboardShares.Remove(share);
            _db.SaveChanges();
        }
    }

    public List<SharedDashboardViewModel> GetDashboardsSharedWithMe(
        int userId)
    {
        return _db.DashboardShares
            .Where(s => s.SharedWithUserId == userId)
            .Select(s => new SharedDashboardViewModel
            {
                DashboardId = s.DashboardId,
                DashboardName = s.Dashboard.Name,
                SharedByName = s.SharedByUser.FullName,
                Permission = s.Permission,
                SharedAt = s.SharedAt
            })
            .OrderByDescending(s => s.SharedAt)
            .ToList();
    }
}

[Authorize]
public class DashboardController : Controller
{
    private readonly AppDbContext _db = new AppDbContext();
    private readonly DashboardSharingService _sharing;

    public DashboardController()
    {
        _sharing = new DashboardSharingService(_db);
    }

    // My Dashboards - shows owned + shared
    public ActionResult Index()
    {
        int userId = GetCurrentUserId();

        var myDashboards = _db.Dashboards
            .Where(d => d.OwnerId == userId && !d.IsArchived)
            .OrderByDescending(d => d.ModifiedAt)
            .ToList();

        var sharedWithMe = _sharing.GetDashboardsSharedWithMe(userId);

        var model = new DashboardIndexViewModel
        {
            MyDashboards = myDashboards,
            SharedWithMe = sharedWithMe
        };

        return View(model);
    }

    // Open designer for creating or editing
    public ActionResult Designer(int? id)
    {
        int userId = GetCurrentUserId();

        if (id.HasValue)
        {
            // Editing existing - check permission
            var dashboard = _db.Dashboards.Find(id.Value);
            if (dashboard.OwnerId != userId)
            {
                var share = _db.DashboardShares
                    .FirstOrDefault(s => s.DashboardId == id.Value
                        && s.SharedWithUserId == userId
                        && s.Permission == "Edit");

                if (share == null)
                    return new HttpStatusCodeResult(403);
            }
        }

        ViewBag.DashboardId = id;
        return View();
    }

    // View-only mode
    public ActionResult Viewer(int id)
    {
        int userId = GetCurrentUserId();
        var storage = new CustomDashboardStorage(_db, userId);

        // This will throw if user has no access
        var dashboard = storage.LoadDashboard(id.ToString());

        ViewBag.DashboardId = id;
        ViewBag.DashboardName = _db.Dashboards.Find(id).Name;
        return View();
    }

    // Share dialog
    [HttpPost]
    public ActionResult Share(int dashboardId,
        int targetUserId, string permission)
    {
        int userId = GetCurrentUserId();
        _sharing.ShareDashboard(dashboardId, userId,
            targetUserId, permission);

        return Json(new { success = true });
    }

    // Revoke access
    [HttpPost]
    public ActionResult Revoke(int dashboardId, int targetUserId)
    {
        int userId = GetCurrentUserId();
        _sharing.RevokeDashboardAccess(dashboardId,
            userId, targetUserId);

        return Json(new { success = true });
    }
}

public class CustomDataSourceStorage : IDataSourceStorage
{
    private readonly AppDbContext _db;
    private readonly string _userRole;

    public CustomDataSourceStorage(AppDbContext db, string userRole)
    {
        _db = db;
        _userRole = userRole;
    }

    public IEnumerable<string> GetAvailableDataSourceIds()
    {
        // Only return data sources this role can access
        return _db.DataSourcePermissions
            .Where(p => p.Role == _userRole && p.CanAccess)
            .Select(p => p.DataSourceName)
            .ToList();
    }

    public DataSourceDocument GetDataSource(string dataSourceId)
    {
        // Verify permission before returning
        var hasAccess = _db.DataSourcePermissions
            .Any(p => p.Role == _userRole
                && p.DataSourceName == dataSourceId
                && p.CanAccess);

        if (!hasAccess)
            throw new UnauthorizedAccessException(
                $"Role '{_userRole}' cannot access '{dataSourceId}'.");

        return LoadDataSourceDefinition(dataSourceId);
    }
}

public static class DashboardConfig
{
    public static void RegisterService(RouteCollection routes)
    {
        routes.MapDashboardRoute("dashboardControl",
            "DefaultDashboard");

        // Configure the dashboard with custom storage
        DashboardConfigurator.Default.SetDashboardStorage(
            new CustomDashboardStorageFactory());

        DashboardConfigurator.Default.SetDataSourceStorage(
            new CustomDataSourceStorageFactory());

        // Restrict designer features based on role
        DashboardConfigurator.Default.CustomizeDashboardArea +=
            (sender, e) =>
            {
                var user = HttpContext.Current.User;

                // View-only users cannot modify the layout
                if (!CanEditCurrentDashboard(user))
                {
                    e.DashboardArea.DashboardDesignerEnabled = false;
                }
            };
    }
}

// Factory creates per-request instances with the current user
public class CustomDashboardStorageFactory
    : IDashboardStorage
{
    public IEnumerable<DashboardInfo> GetAvailableDashboardsInfo()
    {
        var db = new AppDbContext();
        int userId = GetCurrentUserId();
        return new CustomDashboardStorage(db, userId)
            .GetAvailableDashboardsInfo();
    }

    // ... delegate other methods similarly
}