ASP.NET大中小型系统权限管理设计

public class HomeController : Controller
{
    public ActionResult Index()
    {
        return View();
    }
}

public class RequireRolesOrPermissionsAttribute : Attribute
{
    private string[] _rolesOrPermissionsName;

    public RequireRolesOrPermissionsAttribute(params string[] rolesOrPermissionsName)
    {
        this._rolesOrPermissionsName = rolesOrPermissionsName;
    }

    public string[] RolesOrPermissionsName
    {
        get
        {
            return this._rolesOrPermissionsName;
        }
    }
}

public class HomeController : Controller
{
    [RequireRolesOrPermission("System_Admin", "Can_View_Index")]
    public ActionResult Index()
    {
        return View();
    }
}

public class MyAuthorizeAttribute : AuthorizeAttribute
    {        
        private readonly ISecurityService _securityService;

        private string[] rolesOrPermissionsName = null;

        private Dictionary<string, string[]> cacheDic = new Dictionary<string, string[]>();

        private int statusCode;

        public UnitoysAuthorizeAttribute() { }

        public UnitoysAuthorizeAttribute(ISecurityService securityService)
        {
            this._securityService = securityService;
        }

        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            if (filterContext == null)
            {
                throw new ArgumentNullException("filterContext");
            }

            //1. 首先判断用户是否登录。
            if (filterContext.HttpContext.Request.IsAuthenticated)
            {
                var controllerDescriptor = filterContext.ActionDescriptor.ControllerDescriptor;
                var actionDescriptor = filterContext.ActionDescriptor;

                //2. 记录访问的ControllerName和ActionName作为CacheKey。
                var cacheKey = controllerDescriptor.ControllerName + "." + actionDescriptor.ActionName;

                //持久化对象，每次要初始化。
                rolesOrPermissionsName = null;

                //3. 获取访问需要的权限，先判断CacheDictionary里是否存在，不存在则获取并添加到CacheDictionary里。
                if (!cacheDic.ContainsKey(cacheKey))
                {
                    //4. 首先判断Action上是否有定义RequireRolesOrPermissionsAttribute。
                    var attrs = actionDescriptor.GetCustomAttributes(typeof(RequireRolesOrPermissionsAttribute), false);
                    if (attrs.Length == 1)
                    {
                        rolesOrPermissionsName = ((RequireRolesOrPermissionsAttribute)attrs[0]).RolesOrPermissionsName;
                    }
                    else
                    {
                        //5. 如果Action找不到则判断Controller上是否有定义RequireRolesOrPermissionsAttribute。
                        attrs = controllerDescriptor.GetCustomAttributes(typeof(RequireRolesOrPermissionsAttribute), false);
                        if (attrs.Length == 1)
                        {
                            rolesOrPermissionsName = ((RequireRolesOrPermissionsAttribute)attrs[0]).RolesOrPermissionsName;
                        }
                    }
                    if (rolesOrPermissionsName != null)
                    {
                        cacheDic[cacheKey] = rolesOrPermissionsName;
                    }
                }
                else
                {
                    rolesOrPermissionsName = cacheDic[cacheKey];
                }
            }
            base.OnAuthorization(filterContext);
        }

        protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext)
        {
            if (httpContext == null)
            {
                throw new ArgumentNullException("HttpContext");
            }

            //1. 判断是否已经登录，若没有登录则跳转到登录界面。
            if(!httpContext.Request.IsAuthenticated)
            {
                return false;
            }

            if (rolesOrPermissionsName != null)
            {
                //2. 判断当前用户是否拥有访问权限。
                bool isUserInRoleOrHasPermission = _securityService.IsInRole(httpContext.User.Identity.Name, rolesOrPermissionsName);
                
                //3. 如果没有权限则返回403错误。
                if (!isUserInRoleOrHasPermission)
                {
                    statusCode = 403;
                    return false;
                }
            }

            return true;
        }

        protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
        {
            bool isAjaxRequest = filterContext.HttpContext.Request.IsAjaxRequest();

            switch (statusCode)
            {
                case 403:
                    if(isAjaxRequest)
                    {
                        filterContext.Result = new HttpStatusCodeResult(System.Net.HttpStatusCode.Forbidden);
                    }
                    else
                    {
                        ViewResult result = new ViewResult() { ViewName = "AccessDenied" };
                        filterContext.Result = result;
                    }                    
                    break;
                default:                    
                    filterContext.Result = new RedirectResult("/Manage/Login");
                    break;
            }
        }
    }

public bool IsUserInRole(string userName, string[] rolesOrPermissionsName)
        {
            if (rolesOrPermissionsName == null || rolesOrPermissionsName.Length == 0)
            {
                throw new ArgumentNullException("roleOrPermissionNames");
            }

            int calculateCount = rolesOrPermissionsName.Length;

            RoleXUserAccountHandler rxuaHandler = new RoleXUserAccountHandler(_dbContext);
            RoleXPermissionHandler rxpHandler = new RoleXPermissionHandler(_dbContext);
            UserAccountXPermissionHandler uaxpHandler = new UserAccountXPermissionHandler(_dbContext);

            //1. 获取当前用户所有角色。
            List<RoleXUserAccount> rxuaList = rxuaHandler.LoadByUserName(userName);            
            
            foreach (RoleXUserAccount rxua in rxuaList)
            {
                if(calculateCount == 0)
                {
                    break;
                }

                foreach (string roleOrPermissionName in rolesOrPermissionsName)
                {
                    if (rxua.Role.Name.ToUpper() == roleOrPermissionName.ToUpper())
                    {
                        calculateCount--;
                        break;
                    }
                }

                if(calculateCount > 0)
                {
                    //2. 获取角色所拥有的权限。
                    List<RoleXPermission> rxpList = rxpHandler.LoadByRoleName(rxua.Role.Name);

                    foreach (RoleXPermission rxp in rxpList)
                    {
                        if(calculateCount == 0)
                        {
                            break;
                        }

                        foreach (string roleOrPermissionName in rolesOrPermissionsName)
                        {
                            if (rxp.Permission.Name == roleOrPermissionName.ToUpper())
                            {
                                calculateCount--;
                                break;
                            }
                        }
                    }
                }
            }
            //3. 获取用户所有的权限。
            if(calculateCount > 0)
            {
                List<UserAccountXPermission> uaxpList = uaxpHandler.LoadByUserName(userName);

                foreach (UserAccountXPermission uaxp in uaxpList)
                {
                    if(calculateCount == 0)
                    {
                        break;
                    }

                    foreach (string roleOrPermissionName in rolesOrPermissionsName)
                    {
                        if (uaxp.Permission.Name == roleOrPermissionName.ToUpper())
                        {
                            calculateCount--;
                            break;
                        }
                    }
                }
            }
            
            return calculateCount == 0;
        }

public List<RoleXUserAccount> LoadByUserName(string userName)
        {
            List<RoleXUserAccount> rxuaList = null;

            rxuaList = _dbContext.Include(x => x.Role)
                                 .Where(x => x.UserAccount.UserName == userName)
                                 .ToList();

            return rxuaList ?? new List<RoleXUserAccount>();
        }

public List<RoleXPermission> LoadByRoleNameAsync(string roleName)
        {
            List<RoleXPermission> rxpList = null;

            rxpList = _dbContext.Include(x => x.Permission).Where(x => x.Role.Name == roleName).ToList();

            return rxpList ?? new List<RoleXPermission>();
        }

public List<UserAccountXPermission> LoadByUserName(string userName)
        {
            List<UserAccountXPermission> uaxpList = null;

            uaxpList = _dbContext.Include(x => x.Permission).Where(x => x.UserAccount.UserName == userName).ToList();

            return uaxpList ?? new List<UserAccountXPermission>();
        }