I'm developing a project where users need to build reporting queries using complex Linq statements to generate data sets.
The best way I could think of to compile these user-generated queries and then execute them is to use the CSharpCodeProvider object to build an assembly and then store the result in a database blob.
Is there anything wrong with this process? Also, how can I restrict the permissions of the user assembly to only allow execution against a limited set of objects that I provide?
Thanks!