c# – 通用权限管理器模式

这是“我可以访问吗？”的界面.查询：

public interface ICanAccessQuery<TAccount,TEntity>
    where TAccount : IAccountOwner
    where TEntity : IStoredEntity
{
    bool CanView(TAccount user,TEntity entity);
    bool CanEdit(TAccount user,TEntity entity);
}

我的实体现在实现了一个空接口IStoredEntity来制作约束.

这是一个实施的例子：

public class TeacherCanAccessOrdersQuery : ICanAccessQuery<Teacher,Order>
{
    public bool CanView(Teacher user,Order entity)
    {
        var predicate = PredicateBuilder.Create<Order>(x => x.Id == entity.Id && x => x.Account.Id == user.Account.Id);
        return RepositoryProvider.Get<Order>().Count(predicate) > 0;
    }

    public bool CanEdit(Teacher user,Order entity)
    {
        // similar implementation
    }
}

最后,我的新AuthorizationProvider类(从PermissionManager更改名称,不喜欢它)：

public class AuthorizationProvider
{
    public enum Abilities
    {
        View,Edit
    };

    private static IDictionary<string,object> _authorizations = new Dictionary<string,object>();

    // this method should be called at application bootstrap,such as Global.asax in an asp.net app
    public static void Configure()
    {
        _authorizations.Add(typeof(Teacher).Name + typeof(CourseReport).Name,new TeacherCanAccessCourseReportsQuery());
        _authorizations.Add(typeof(Teacher).Name + typeof(Order).Name,new TeacherCanAccessOrdersQuery());
        // other rules user type-entity type
    }

    // Can I view entity with primary key X?
    public static bool CanI<TEntity>(Abilities ability,object entityKey)
        where TEntity : IStoredEntity
    {
        TEntity entity = RepositoryProvider.Get<TEntity>().Load(entityKey);
        return CanI<TEntity>(ability,entity,AccountRoles.Admin);
    }

    // Can I view entity (and if I have a specific role,I surely can)?
    public static bool CanI<TEntity>(Abilities ability,TEntity entity,params string[] authorizedRoles)
        where TEntity : IStoredEntity
    {
        var principal = Thread.CurrentPrincipal as MyCustomPrincipal;

        if (authorizedRoles.Any(r => principal.IsInRole(r)))
            return true;

        var user = RepositoryProvider.Get<Account,AccountRepository>().GetUser(principal.AccountId);

        // my system has only two types of users
        if (user is Teacher)
        {
            return Can<Teacher,ability,entity);
        }
        else if (user is TrainingCenter)
        {
            return Can<TrainingCenter,entity);
        }
        return false;
    }

    /// Can user X (view|edit) entity Y?
    /// With some reflection I call the needed method. In this way I can add "abilities" to my ICanAccessQuery
    /// interface and its implementations without altering this class.
    public static bool Can<TAccount,Abilities ability,TEntity entity)
        where TAccount : IAccountOwner
        where TEntity : IStoredEntity
    {
        var key = typeof(TAccount).Name + typeof(TEntity).Name;
        if (_authorizations.ContainsKey(key))
        {
            var query = (ICanAccessQuery<TAccount,TEntity>)_authorizations[key];
            string methodName = "Can" + ability.ToString();

            var method = typeof(ICanAccessQuery<TAccount,TEntity>).GetMethod(methodName);
            return (bool)method.Invoke(query,new object[] { user,entity });
        }
        return false;
    }
}

在asp.net mvc控制器中使用的一个示例：

public ActionResult Details(long? id)
{
    if (!id.HasValue)
        return new EmptyResult();

    if (!AuthorizationProvider.CanI<CourseReport>(AuthorizationProvider.Abilities.View,id.Value))
        return RedirectToAccessDenied();

     // etc.
}