Asp.net Mvc4 基于Authorize實(shí)現(xiàn)的模塊權(quán)限驗(yàn)證方式

1、在MVC中，我們可以通過(guò)在action或者controller上設(shè)置AuthorizeRole="xxx" 的方式來(lái)設(shè)置用戶對(duì)action的訪問(wèn)權(quán)限。顯然，這樣并不能滿足我們的需求，對(duì)于一般的MVC系統(tǒng)來(lái)說(shuō)，如果我們定義一個(gè)controller來(lái)處理一個(gè)模塊的話，我們大致有以下需求：一，單個(gè)action的訪問(wèn)權(quán)限。如果刪除，列表action二，一個(gè)action兩種權(quán)限，如edit(int? id)如果id為null則添加，或者修改三，在此cotroller驗(yàn)證其它模塊權(quán)限，比如，我們要在新聞模塊獲取新聞列表四，對(duì)于某些通過(guò)模塊，如分類，我們希望通過(guò)傳入不同的參數(shù)可以驗(yàn)證不同

2、模塊的權(quán)限對(duì)于四種情況，我理想的想法是：對(duì)于第一種，直接制定controller的moduleid和action的權(quán)限 Module(ModuleId=6)public class Controller: Controller SysAuthorize(Permission.List) /設(shè)置action要驗(yàn)證的權(quán)限 public ActionResult List()  對(duì)于第二種情況，我們希望通過(guò)參數(shù)來(lái)達(dá)到驗(yàn)證那個(gè)權(quán)限的目的： Module(ModuleId=6) public class Controller: Controller /如果參數(shù)為null是將驗(yàn)證添加權(quán)限否則驗(yàn)證

3、修改權(quán)限 SysAuthorize(Permission.Add,Permission.Edit,"id",null) public ActionResult Edit(int? id)  對(duì)于第三種情況，我們可以為action驗(yàn)證指定單獨(dú)的模塊id Module(ModuleId=6) public class Controller: Controller SysAuthorize(9,Permission.List) /此方面驗(yàn)證模塊9的列表權(quán)限 public ActionResult List(int CType)  對(duì)于第四種情況，我們可以為模塊

4、添加不同的參數(shù)module對(duì)應(yīng)關(guān)系 Module(ModuleId=5,"CType",1) Module(ModuleId=6,"CType",2) public class Controller: Controller 如果當(dāng)前傳入CType為1則驗(yàn)證ModuleId=5,等于2是驗(yàn)證ModuleId=6 SysAuthorize(Permission.List) public ActionResult List(int CType)  想法定好以后，我們就可以去實(shí)現(xiàn)了。首先，我們定義一個(gè)module的特性：/ <summary>

5、;/ 模塊信息特性/ </summary>AttributeUsage(AttributeTargets.Class, Inherited = true, AllowMultiple = true)public class ModuleAttribute : Attribute public ModuleAttribute() public ModuleAttribute(int moduleId) this.ModuleId = moduleId; public ModuleAttribute(int moduleId, string parName, object value)

6、 : this(moduleId) this.ParameterName = parName; this.ParameterValue = value; / 模塊Id / </summary> public int ModuleId get; set; / <summary> / 當(dāng)前模塊對(duì)應(yīng)參數(shù)名 / </summary> public string ParameterName get; set; / <summary> / 當(dāng)前模塊參數(shù)值 / </summary> public object ParameterValue get;

7、 set; / <summary> / 驗(yàn)證參數(shù)值是否有正確 / </summary> public bool CheckParameter(HttpRequestBase request) var val = requestParameterName; bool b = false; if (val = null && ParameterValue = null) b = true; else if (val != null && ParameterValue != null && val = ParameterValu

8、e.ToString() b = true; return b; View Code  實(shí)現(xiàn)了模塊特性以后，就是比較重要的驗(yàn)證特性了：/ <summary>/ 系統(tǒng)權(quán)限驗(yàn)證/ <remarks>/ 0，只驗(yàn)證登陸：無(wú)參數(shù)時(shí)，只驗(yàn)證登陸/ 1，單一：只一指定權(quán)限代碼時(shí)驗(yàn)證當(dāng)前模塊的指定權(quán)限/ 2，二選一：指定兩種權(quán)限代碼時(shí)，根據(jù)參數(shù)驗(yàn)證，如果參數(shù)等于指定參數(shù)，則驗(yàn)證前者，否則驗(yàn)證后者/ </remarks>/ </summary>AttributeUsage(AttributeTargets.Class | AttributeTarget

9、s.Method, Inherited = true, AllowMultiple = false)public class SysAuthorizeAttribute : AuthorizeAttribute / <summary> / 驗(yàn)證是否登陸 / </summary> public SysAuthorizeAttribute() / 驗(yàn)證基本權(quán)限 / </summary> public SysAuthorizeAttribute(Permission permission) this.PermissionFlag = permission; / &

10、lt;summary> / 驗(yàn)證基本權(quán)限 / </summary> public SysAuthorizeAttribute(int moduleId, Permission permission) : this(permission) this.ModuleId = moduleId; this.IsSetModuleId = true; / <summary> / 帶參數(shù)的驗(yàn)證 / </summary> public SysAuthorizeAttribute(Permission permission, string parName, objec

11、t value = null) this.PermissionFlag = permission; this.ParameterName = parName; this.ParameterValue = value; / <summary> / 帶參數(shù)的驗(yàn)證 / </summary> public SysAuthorizeAttribute(int moduleId, Permission permission, string parName, object value = null) : this(permission, parName, value) this.Mo

12、duleId = moduleId; this.IsSetModuleId = true; / <summary> / 帶參數(shù)的驗(yàn)證二選一 / </summary> public SysAuthorizeAttribute(Permission before, Permission after, string parName, object value = null) this.PermissionFlag = before; this.PermissionFlag1 = after; this.ParameterName = parName; this.Paramet

13、erValue = value; / <summary> / 帶參數(shù)的驗(yàn)證二選一 / </summary> public SysAuthorizeAttribute(int moduleId, Permission before, Permission after, string parName, object value = null) : this(before, after, parName, value) this.ModuleId = moduleId; this.IsSetModuleId = true; / <summary> / 當(dāng)前要驗(yàn)證的

14、權(quán)限代碼 / </summary> private Permission? PermissionFlag get; set; / <summary> / 當(dāng)前要驗(yàn)證的另一個(gè)權(quán)限代碼（當(dāng)二選一驗(yàn)證驗(yàn)證方式時(shí)有效） / </summary> private Permission? PermissionFlag1 get; set; / <summary> / 是否自定義設(shè)置了moduleId / </summary> private bool IsSetModuleId get; set; / <summary> / 獲取或設(shè)

15、置當(dāng)前模塊Id / </summary> public int? ModuleId get; set; / <summary> / 權(quán)限驗(yàn)證參數(shù)名 / </summary> public string ParameterName get; set; / <summary> / 權(quán)限驗(yàn)證參數(shù)值 / </summary> public object ParameterValue get; set; / <summary> / 驗(yàn)證結(jié)果 / </summary> public bool AuthorizeResult

16、 get; private set; / <summary> / 驗(yàn)證前獲取moduleId / </summary> public override void OnAuthorization(AuthorizationContext filterContext) if (!IsSetModuleId) var modules = filterContext.Controller.GetModules(); /一個(gè)模塊的的時(shí)候，只第一次進(jìn)入時(shí)獲取他的模塊id，緩存以后不作處理 if (modules.Count = 1 && ModuleId = nul

17、l) if (!string.IsNullOrWhiteSpace(modules0.ParameterName) if (modules0.CheckParameter(filterContext.HttpContext.Request) ModuleId = modules0.ModuleId; else ModuleId = modules0.ModuleId; /多個(gè)模塊的時(shí)候，每次驗(yàn)證強(qiáng)制更新及moduleid else if (modules.Count > 1) foreach (var m in modules) if (m.CheckParameter(filterCo

18、ntext.HttpContext.Request) ModuleId = m.ModuleId; break; base.OnAuthorization(filterContext); / <summary> / 核心驗(yàn)證 / </summary> protected override bool AuthorizeCore(HttpContextBase httpContext) /如果未登陸，則跳轉(zhuǎn)到登陸頁(yè) if (!httpContext.User.Identity.IsAuthenticated) httpContext.Response.Redirect(Fo

19、rmsAuthentication.LoginUrl); AuthorizeResult = true; if (PermissionFlag != null) if (PermissionFlag.Value = Permission.Administrator) return AdminSiteService.CheckAdministrator(); /未設(shè)置模塊id，則拋出異常 if (ModuleId = null) throw new Exception(string.Format("未設(shè)置模塊id的Control不能進(jìn)行權(quán)限驗(yàn)證!"); /處理二選一 if (

20、PermissionFlag1 != null) if (string.IsNullOrWhiteSpace(ParameterName) throw new Exception(string.Format("請(qǐng)為二選一驗(yàn)證指定相應(yīng)的參數(shù)名!"); /如果參數(shù)值等于給定值，則驗(yàn)證前者，否則驗(yàn)證后者 if (CheckParameter(httpContext.Request) AuthorizeResult = AdminSiteService.CheckPermission(ModuleId.Value, (int)PermissionFlag.Value); else

21、AuthorizeResult = AdminSiteService.CheckPermission(ModuleId.Value, (int)PermissionFlag1.Value); else /一般驗(yàn)證處理 /如果參數(shù)名不為空，則先驗(yàn)證參數(shù)值是否匹配 if (!string.IsNullOrWhiteSpace(ParameterName) AuthorizeResult = CheckParameter(httpContext.Request); if (AuthorizeResult) AuthorizeResult = AdminSiteService.CheckPermiss

22、ion(ModuleId.Value, (int)PermissionFlag.Value); return AuthorizeResult; / <summary> / 錯(cuò)誤處理 / </summary> protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext) filterContext.Result = new RedirectResult("/Main/Error?code=100"); / <summary> / 驗(yàn)

23、證參數(shù)值是否有正確 / </summary> private bool CheckParameter(HttpRequestBase request) var val = requestParameterName; bool b = false; if (val = null && ParameterValue = null) b = true; else if (val != null && ParameterValue != null && val = ParameterValue.ToString() b = true; ret

24、urn b; View Code  注意AuthorizeAttribute緩存問(wèn)題。第一訪問(wèn)時(shí)會(huì)緩存該Action的身份認(rèn)證類，所以多模塊驗(yàn)證時(shí)需要重新獲取moduleId如果當(dāng)前AuthorizeAttribute沒有指定moduleid，則每次訪問(wèn)強(qiáng)制更新其moduleId補(bǔ)充一下獲取控制器模塊的擴(kuò)展方法：/ <summary> / 獲取控制器相關(guān)模塊 / </summary> public static List<ModuleAttribute> GetModules(this ControllerBase controller, bool

25、 useCache = true) if (controller = null) return null; string cacheKey = string.Format("0_Modules", controller.GetType().Name); if (useCache) if (CacheProvider.Cache.Contains<List<ModuleAttribute>>(cacheKey) return CacheProvider.Cache.Get<List<ModuleAttribute>>(cache

26、Key); var moduleInfos = controller.GetType().GetCustomAttributes(typeof(ModuleAttribute), false); List<ModuleAttribute> modules = new List<ModuleAttribute>(); if (moduleInfos.Length <= 0) return modules; foreach (var m in moduleInfos) modules.Add(ModuleAttribute)m); if (useCache) /緩存控

27、制器模塊信息 CacheProvider.Cache.Add<List<ModuleAttribute>>(cacheKey, modules, 20); return modules; View Code   驗(yàn)證方法主要是幫我們區(qū)分出是驗(yàn)證哪一個(gè)模塊的哪一個(gè)權(quán)限，最后把模塊id和權(quán)限標(biāo)識(shí)傳入我們的邏輯層進(jìn)行驗(yàn)證，我們可以在登陸的時(shí)候緩存用戶的模塊權(quán)限。驗(yàn)證大致代碼： / <summary> / 判斷當(dāng)前登陸用戶對(duì)操作是否有權(quán)限 / </summary> public static bool CheckPermission(

28、int ModuleId, int permissionFlag) /FormsAuthentication.GetAuthCookie() var user = HttpContext.Current.User; /未登陸的用戶 if (!user.Identity.IsAuthenticated) return false; AdminInfo info = GetLoginAdminInfo(); /超級(jí)管理員有所有權(quán)限 if (info.RoleId = Constant.AdministratorRoleId) return true; if (!info.ModulePermiss

29、ions.Exists(t => t.AdminId = info.AdminId && t.ModuleId = ModuleId && t.PermissionFlag = permissionFlag) return false; return true; View Code  最后，我們就可以在我們的系統(tǒng)中使用了：using FL.Entitys;using FL.Site.Service;using FL.Site.SysManager.Common;using System;using System.Collections.Gener

30、ic;using System.Linq;using System.Web;using System.Web.Mvc;using FL.Site.ViewModel;using FL.Site.SysManager.JUI;namespace FL.Site.SysManager.Controllers Module(ModuleId = 7) public class AdminController : BaseController<AdminSiteService> / <summary> / 分頁(yè)列表 / </summary> SysAuthorize

31、(Permission.List) public ActionResult List(PagerPostItem postPager) var pager = new PagerItem(postPager, TargetType.NavTab); int recordCount; var list = Service.GetPageList(pager.currentPage, pager.numPerPage, out recordCount); pager.totalCount = recordCount; var roles = new RoleSiteService().GetRol

32、es(); ViewBag.Roles = roles; return View(list, pager); / <summary> / 編輯輸入 / </summary> SysAuthorize(Permission.Add, Permission.Update, "id") public ActionResult Edit(int? id) var entity = new AdminSaveModel(); if (id != null) entity = Service.GetById(id.Value); var roles = new

33、RoleSiteService().GetRoles(); ViewBag.Roles = new SelectList(roles, "RoleId", "RoleName", entity.RoleId); return View(entity); / <summary> / 保存數(shù)據(jù) / </summary> HttpPost SysAuthorize(Permission.Add, Permission.Update, "AdminId", 0) public ActionResult Edit(AdminSaveModel entity) entity.LastUpdateTime = DateTime.Now; entity.LastUpdateAdmin = UserInfo.LoginName; if (ModelState.IsValid) return Json(Service.Save(entity); else return Json(AjaxResult.NewModelCheckErrorResult(ModelState); / <summary> /