如何处理在MVC的行动为基础的权限 [英] How to handle action based permissions in MVC

问题描述

我是新来的MVC，我希望得到我的应用程序如何以最佳方式处理行动为基础的权限的建议。

I'm new to MVC and I would like to get suggestions on how to best handle action based permissions in my application.

我目前正在已经在这对渲染视图当前用户做工精细控制器级别查了一些全局权限访问等。

I currently have some global permissions being checked at the controller level which work fine for rendering views the current user has access to, etc.

然而，一旦视图已经被渲染，我要做出决定，如启用删除按钮，只要用户有删除权限当前选定的项目在这一点上，这些权限不再是全球而是基于该对象的上下文选择。

However, once the view has been rendered, I want to make decisions such as 'enable DELETE button, ONLY IF user has delete permissions for the item currently selected' At that point, those permissions are no longer Global but based on the context of the object selected.

我应该怎么写我的code来处理这种类型的场景？

How should I write my code to handle this type of scenario?

推荐答案

默认情况下，您的意见可以访问用户对象。

By Default your Views have access to the User Object.

您可以检查查看是否User.IsInRole（myDeleteRole）。

You can check on the View if User.IsInRole("myDeleteRole").

或

@if(User.IsInRole("MyDeleteRole"))
{
<input type="subtmt" value="Delete">
}

我不知道这是不是最好的方式，但它是我在过去所做的那样。

I don't know if this is the best way, but its what i have done in the past

我想另一个办法是根据用户所拥有的权限编写单独的意见。这样你可以做控制器上的逻辑和用户发送到指定的视图

I guess another way would be to write seperate Views depending on what rights a user has. that way you could do the logic on the controller and send the user to the specified view

if(User.IsInRole("MyDeleteRole")
{
return View("MyDeleteView", vm)
}
else
{
return View("NoDeleteView", vm)
}

这篇关于如何处理在MVC的行动为基础的权限的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！