Refactor the view model protection mechanism and serializer by @exyi.

You should be able to execute command on property change.
This is useful for any kind of "selection/value changed" binding. For example cascade combo boxes.

1. The user fills some form controls (e.g. textbox).
2. The user navigates to another page.
3. The user presses Back button in the browser.
4. The browser fills the form controls with the values automatically but in the viewmodel there is null on each property.

It happens in Google Chrome and maybe in other browsers.

I have found critical security bug in CommandResolver.
Open 'Sample 6 - ViewModel property encryption and protection' and run this in developer console

redwood.postBack('root', document, [], 'set_ReadOnlyData(SecretData)', '')

and see what is in protected data in viewmodel. This invocation has modified readonly data and read secret data.
I think we should read all binding before sending to client and then accept only these registered binding expressions. I hope this will help. We can also cache parsed binding expression to improve performance.

GridView

• basic features are already implemented
• inline editing
• more cell customizations
• support for column resizing (and the customizations are persisted in the local storage)

ListView

• basically Repeater with inline editing, empty data template and other features

CollectionEditor

• a control where the user can enter one or more values
• each row is an instance of template

CheckBoxList, RadioButtonList

Implement a new type of a binding {resource: ResourceType.ResourceKey } that will load the value from the resource file and create function for changing the culture from viewmodel code.

1. Content Page template should allow user to select the viewmodel and master page in some window
2. ViewModel should allow to create a new view or attach to an existing one
3. Template for user control should be added

Update the tokenizer to handle unfinished elements and bindings.
Implement the IntelliSense for directives, attributes and binding types.

The custom serialization must reflect the Bind() attribute in the C# viewmodel.

The following binding options should be implemented:

1. TwoWay
2. OneWay (server to client only)
3. OneWayToSource (client to server only)
4. OneTime (server to client but only on initial page load)

RwHtml parser should support

• DOCTYPE - after directives and before html
• comments - at least traditional html ones, serve-side only may be also useful
• CDATA section - stuff inside will be html escaped

Scripts and styles should be embedded in the page by the framework, there is no need to explicitly use them from the markup.
Also the RedwoodView and ResourceLinks controls should be placed in different namespace so they cannot be used from the markup.

When deserializing there is no control if object in array I really belongs to this property.
In the 'Sample 6 - ViewModel property encryption and protection' first remove explicit proteced data validation (method ValidateSecretDataDecryptedSuccessfully). Then you can run this command in developer console to display SecretData property.

redwood.viewModels.root.ReadOnlyData$encrypted(redwood.viewModels.root.SecretData$encrypted())

Add a sample for GridView control and support sorting.

Controls should have their own control state which is persisted in the viewmodel.

Current template uses old project and .NET 4.5.1.
We need also a new template targetting the new project system.

Now property of viewmodel property can be protected, but it is pretty insecure, because class is included optionally (can be replaced by null or removed from array) and its encrypted value can overflow to some read-only property.
I have made little example in protection-vunerability-demo branch. Just run following in developer console

redwood.viewModels.root.ProtectedTasks.remove(redwood.viewModels.root.ProtectedTasks()[0])

and do a postback.
We can enable protection only in main viewmodel, but I think it's not needed.
Maybe it can be solved by appending to EncryptedValues number of new elements added while serializing the property. On deserialization check if it fits.
In my sample it will look like

[
  "secret task data",
  "secret task data",
  "secret task data",
  3, // number of encrypted values in ProtectedTasks property
  "This property can be read on the client but when you modify it, the server won't accept the request.",
  "This is encrypted and cannot be displayed on the client."
]

Do you think it will be safe?

Rwhtml is ugly in Dark theme

I am using Visual Studio CTP 6 and Redwood extension 0.5

Intellisense is fine.

It causes many exceptions on the client when something is null.

UserControl can have the view defined in .rwhtml.
The controls must support Init, Load, PreRender, InitComplete, LoadComplete and PreRenderComplete methods that must be called during the page lifecycle.
A new binding of type {controlProperty: expression} should be supported in the future.
A new binding of type {controlCommand: function} should be supported in the future.

Currently rwhtml is using single curly brace in attribute binding and double in HTML element content, like: <p class="{value: Result}">{{value: Result}}<p>.
We should use single brace everywhere. For example:
<p class="{value: Result}">{value: Result}<p>.

You should be able to escape opening binding with two opening curly braces.

Add a link to the VSIX extension
Update first pages where the files are created manually - the extension now does this
Add a page about action filters
Add a page about IoC/DI and testability of viewmodel

Implement the action filtering mechanism similar to ASP.NET Web API and MVC. The filters can be applied:

• on the method level
• on the viewmodel level
• globally

Then implement the Authorize attribute (which is an action filter) and a RedirectToLoginPageAttribute that redirects to a specified URL when an UnauthorizedAccessException occurs.

It is a security issue.

Create attached property PostBack.Update="true" which will re-render the control on postback and send the HTML to the client. The client replaces the control content with new HTML that came from the server.
Also implement a Render.Mode="Server/Client" that will turn the client rendering on or off. In Server mode, the bindings are evaluated on the server and pure HTML without knockout stuff is generated.

CSRF protection
ViewModel encryption and signing using classes written by @ridercz

When the DefaultViewCompilers compile a complex page with master page and templates for the first time, it works. When the compiled output is cached, the next time the page injects incorrect template.

Currently the property in markup is mapped on RedwoodProperties. When a redwood property is not found, we should try to map it to the actual property on the class.

Introduce an attribute that will indicate that the control in the markup cannot have any content.

It greatly enhances the experience of using the framework.

Currently the framework allows to create several concurrent postbacks. E.g. when the user clicks the button twice, two postbacks are sent to the server and if the responses come in different order, the viewmodel can break.

We need to update the parser to be case insensitive, and implement a method that fixes the casing.

SpaContentPlaceHolder can be used only once in a page and the content is loaded using AJAX.

RouteLink will allow to create a hyperlink to a route.
Attributes beginning with Param- will be passed in the route:

<rw:RouteLink RouteName="NameOfRoute" Param-Id="{value: MenuItemId}" />

The prefix is necessary because we might want to specify HTML attributes that will be applied to the link. Also we need a function that builds the route URL.

Many controls and HTML elements do not have Click handler and it is not wise to add it to all of them. Instead a concept of Decorator should be implemented. Each BindableControl will have an option to declare whether it can be decorated or not, and when it can, one or more decorators can be applied to it. They will be allowed to wrap the control in a HTML element or add an attribute to it.
It should be easy to apply a decorator, e.g. via attached property.

Example (we consider a decorator named EventsDecorator):

<tr Event.Click="{command: Test()}">...</tr>

To make the tests working in pure VisualStudio

They should be generated from .NET culture info dynamically.

@viewmodel: Redwood.Samples.BasicSamples.ViewModels.Sample2ViewModel, Redwood.Samples.BasicSamples

Should be:

@viewmodel Redwood.Samples.BasicSamples.ViewModels.Sample2ViewModel, Redwood.Samples.BasicSamples

Please update parser and samples.

We need to design some extensible validation.
There are many decisions to be made:

• will we use validation groups, or we are always going to validate whole viewmodel or its subtree
• what JS library will we use
• how that will be connected to the model validation, we'll also need the ModelState in the viewmodel

Create javascript events onInit, onError, onBeforePostback, onAfterPostback.
Allow controls to add scripts to the page.