Odata 保护多租户Web API应用程序中的数据访问

我有一个一直在开发的WebAPI2.2应用程序，我正试图确保跨租户的数据访问安全

为了简单起见，我使用一个可重用的where子句锁定对实体的访问，该子句接受用户的身份验证令牌，然后过滤它们的结果：

// GET: odata/Contacts
    [Queryable]
    public IQueryable<Contact> GetContacts()
    {
        return db.Contacts.Where(_appContext.Helper.Expr_AppContactsFilter);
    }

但是，如果我试图通过所有者属性扩展我有权访问的联系人列表，或者使事情变得更复杂，并从另一个实体向上导航到联系人，然后是所有者，我就能够访问可能不属于我租赁的实体：

通过Contacts（）访问-/odata/Contacts？$expand=Owner

{  
   "odata.metadata":".../odata/$metadata#Contacts",
   "value":[  
      {  
         "Owner":{  
            "ID":4,
            ...
            "Application_ID":2 //here we see the owner is not part of this tenant
         },
         "ID":2,
         "Owner_ID":4,
         "Application_ID":1,
        ...
      },
      {  
         "Owner":{  
            "ID":1,
            "FirstName":"System",
            "Application_ID":null, //here we see the owner is not part of this tenant
            ...
         },
         "ID":3,
         "FirstName":"Bruce",
         "Owner_ID":1,
         "Application_ID":1,
      }
   ]
}

通过两级导航-…/odata/网站（2）？$expand=联系人/所有者

{  
   "odata.metadata":".../odata/$metadata#Websites/@Element",
   "Contact":{  
      "Owner":{  
         ...
         "Application_ID":2,  //here we see the owner is not a part of this tenant
      },
      "ID":2,
      "FirstName":"Shawn",
      "MiddleName":"",
      "LastName":"Souto",
      "Organization":"SSI Design",
      "Owner_ID":4,
      ...
   },
   "ID":2,
   "URL":"http://www.example.com",
    ...
}

是否有方法过滤$expand逻辑或其他odata参数以保持租户内的访问权限

另外，有没有更好的方法来做到这一点（这仍然相对简单），而不必完全重做所有API控制器逻辑

{  
   "odata.metadata":".../odata/$metadata#Contacts",
   "value":[  
      {  
         "Owner":{  
            "ID":4,
            ...
            "Application_ID":2 //here we see the owner is not part of this tenant
         },
         "ID":2,
         "Owner_ID":4,
         "Application_ID":1,
        ...
      },
      {  
         "Owner":{  
            "ID":1,
            "FirstName":"System",
            "Application_ID":null, //here we see the owner is not part of this tenant
            ...
         },
         "ID":3,
         "FirstName":"Bruce",
         "Owner_ID":1,
         "Application_ID":1,
      }
   ]
}

{  
   "odata.metadata":".../odata/$metadata#Websites/@Element",
   "Contact":{  
      "Owner":{  
         ...
         "Application_ID":2,  //here we see the owner is not a part of this tenant
      },
      "ID":2,
      "FirstName":"Shawn",
      "MiddleName":"",
      "LastName":"Souto",
      "Organization":"SSI Design",
      "Owner_ID":4,
      ...
   },
   "ID":2,
   "URL":"http://www.example.com",
    ...
}