Question

I have a view to display a list of items.
The user can edit, delete or create new items, but according to their authorizations they may or may not be allowed to do some of this actions.

I have the requirement to display only the actions which the current user is allowed to do, but I don’t want to clutter the views with authorization if-else’s

Despise of being a very common requirement, I can’t find a real satisfactory way of doing it.

My best approach so far is to provide an overload to the Html.ActionLink extension method that takes the permission to ask for, but there are going to be more complex scenarios, like hiding entire blocks of html or switching a textbox for a label+hidden.

Is there a better way to do this?

Answer 1

One example I can think of would be to invoke Html.RenderAction (link: http://msdn.microsoft.com/en-us/library/ee703490.aspx), and then pass the link you wish to use as a route value to the action method (it will appear as a parameter on your action). Because it’s a RenderAction, you get to go back through the controller process and thus you can have it render whatever view or data you want depending on the user’s state.

Example:

<% Html.RenderAction("Permissions" /* Controller */, "PermissionLink", new { Url = "Admin.aspx" }); %>

And your controller would have something like:

public ActionResult PermissionsLink (string url)
{
     // Do Whatever kind of Authentication you want here, Session is available, etc

     if(authenticated)
        return View("Link");
     else
        return View("Blank");
}