程序员的自我救赎---7.2：权限系统实际应用

using System;
using System.Collections.Generic;
using System.Dynamic;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using System.Web.Routing;
using Winner.Framework.MVC.GlobalContext;
using Winner.Framework.Utils.Model;

namespace Winner.Framework.MVC
{
    /// <summary>
    /// 验证身份：检查访问权限
    /// </summary>
    public class AuthRightAttribute : AuthLoginAttribute
    {
        /// <summary>
        /// 实例化一个新的验证对象
        /// </summary>
        /// <param name="ignore">是否忽略检查</param>
        public AuthRightAttribute(bool ignore = false)
            : base(ignore)
        {
        }
        /// <summary>
        /// 权限验证，继承登陆验证
        /// </summary>
        /// <param name="context"></param>
        protected override bool OnAuthorizationing(AuthorizationContext context)
        {
            //1.判断是否登陆成功
            if (!base.OnAuthorizationing(context))
            {
                return false;
            }

            //2.忽略权限检查
            if (GlobalConfig.IgnoreCheckRight)
            {
                return true;
            }
            //3.如果是Ajax请求则不检查权限
            if (base.ContextProvider.IsAjaxRequest && GlobalConfig.IgnoreAjaxRequestCheckRight)
            {
                return true;
            }
            //4.获取路径，如：/区域/控制器/动作/
            string url = string.Empty;
            if (!string.IsNullOrEmpty(ContextProvider.Area))
            {
                url = "/" + ContextProvider.Area;
            }
            url += string.Format("/{0}/{1}/", ContextProvider.Controller, ContextProvider.Action);
            //5.判断权限
            if (!ApplicationContext.HaveRight(ApplicationContext.Current.User.UserId, url))
            {
                //无法跳转到根目录下
                //context.Result = new RedirectToRouteResult(new RouteValueDictionary(new { Controller = "Home", action = "Right" }));

                if (base.ContextProvider.IsAjaxRequest)
                {
                    OutputResult("此功能未授权，请联系管理员！", 403);
                }
                else
                {
                    //TODO:未测试 指定Default的路由器下的
                    context.Result = new RedirectToRouteResult("Default", new RouteValueDictionary(new { Controller = "Home", action = "Right" }));

                }
                return false;
            }
            return true;
        }
    }
}