Question

I will have many Roles, and each Role has many functions, so the RequireRoles Attribute I don’t think will suffice in my case. I need some way to dynamically let the Controller action define to the View what sections and/or controls in the View (without adding if/else logic inside the View).

My thought is that the Controller should be telling the View how to present itself and not the View with the if/else logic.

Any ideas on how to design this ?

Answer 1

You need to first of all create a filter which you can use an attribute to control what roles see what actions. See http://www.asp.net/mvc/tutorials/older-versions/controllers-and-routing/understanding-action-filters-cs.

public class RequiresRoleAttribute : ActionFilterAttribute {
    private List<string> requiredRoles = null;

    /// <summary>
    /// Initializes a new instance of the <see cref="RequiresRoleAttribute"/> class.
    /// </summary>
    /// <param name="roleNames">The role names.</param>
    public RequiresRoleAttribute(params string[] roleNames) {
        this.requiredRoles = new List<string>(roleNames);
    }

    /// <summary>
    /// Called by the MVC framework before the action method executes.
    /// </summary>
    /// <param name="filterContext">The filter context.</param>
    public override void OnActionExecuting(ActionExecutingContext filterContext) {
        bool hasRole = false;

        // check to see if the user has the proper role here

        // if the do not have the role, they are not allowed to execute the action
        if (!hasRole)
            throw new UserAccessException("You do not have access to this action (" + filterContext.ActionDescriptor.ActionName + ", " + filterContext.ActionDescriptor.ControllerDescriptor.ControllerName + ")");

        base.OnActionExecuting(filterContext);
    }
}

Second to solve your problem of no logic in the views you could use child actions for each section which requires a role. Again you could apply your filter to the child actions. For more on child actions see: http://msdn.microsoft.com/en-us/library/ie/ee839451.aspx.

What you would need to change is the section that throws the exception. You’d need to check to see if the action being executed is a child action. If so, you’d want to return an empty content result.