MVC2 C# 根据 ID 限制对视图的访问

Question

我有两张表，一张包含职位，一张包含经理，当将职位 ID 传递到“详细信息”视图时，可以访问该职位的详细信息。

Job_id  Job_Title       Manager_id
23      Chimney Sweep   65
24      Rat Catcher     84

Managers    Email
65          [email protected]
66          [email protected]

我想根据 manager_email 限制对视图的访问 - 例如，如果我们在 http://jobsite/ jobs/Detail/23 那么只有 Arthur 可以访问该视图.. 将使用 AD 来挑选用户的电子邮件..

任何指示将不胜感激！

Answer 1

您可以编写一个自定义模型绑定器：

public class JobModelBinder : DefaultModelBinder
{
    public override object BindModel(ControllerContext controllerContext, ModelBindingContext bindingContext)
    {
        // fetch the job id from the request
        var jobId = controllerContext.RouteData.Values["id"];

        // fetch the currently connected username
        string user = controllerContext.HttpContext.User.Identity.Name;

        // Remark: You might need an additional step here
        // to query AD and fetch the email

        // Given the job id and the currently connected user, try 
        // to fetch the corresponding job
        Job job = FetchJob(jobId, user);

        if (job == null)
        {
            // We didn't find any job that corresponds to
            // the currently connected user
            // => we throw
            throw new HttpException(403, "Forbidden");
        }
        return job;
    }

    private Job FetchJob(int jobId, string user)
    {
        throw new NotImplementedException();
    }
}

然后拥有您的控制器：

public class JobsController : Controller
{
    [Authorize]
    public ActionResult Show([ModelBinder(typeof(JobModelBinder))]Job job)
    {
        return View(job);
    }
}

自定义模型绑定器也可以在 Application_Start 中注册：

protected void Application_Start()
{
    ...
    ModelBinders.Binders.Add(typeof(Job), new JobModelBinder());
}

这将简化您的控制器操作：

public class JobsController : Controller
{
    [Authorize]
    public ActionResult Show(Job job)
    {
        // If we get to that point it means that the
        // currently connected user has the necessary
        // permission to consult this view. The custom
        // model binder would have populated the Job model
        // and we can safely pass it to the view for display
        return View(job);
    }
}

这种方法的另一个优点是您可以注入依赖项进入自定义模型绑定器的构造函数。当尝试与 AD 和数据库通信时，它可能需要这些依赖项。