ASP.NET MVC：操作内的授权 - 建议模式还是这是一种味道

，并添加案例代码。

csharp
public class Role
{
    public string Name { get; set; }
    public List Permissions { get; set; }
}
public class RoleManager
{
    public List GetRoles()
    {
        // 从数据库或配置文件中获取角色列表
        return new List()
        {
            new Role()
            {
                Name = "Admin",
                Permissions = new List() { "Create", "Update", "Delete" }
            },
            new Role()
            {
                Name = "User",
                Permissions = new List() { "Read" }
            }
        };
    }
}

csharp
public class CustomAuthorizeAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        RoleManager roleManager = new RoleManager();
        string[] requiredPermissions = this.Roles.Split(',');
        foreach (string permission in requiredPermissions)
        {
            if (!roleManager.GetRoles().Any(r => r.Permissions.Contains(permission)))
            {
                filterContext.Result = new HttpUnauthorizedResult();
                return;
            }
        }
        base.OnAuthorization(filterContext);
    }
}
public class HomeController : Controller
{
    [CustomAuthorize(Roles = "Create,Update")]
    public ActionResult Create()
    {
        // 创建操作的逻辑
        return View();
    }
    [CustomAuthorize(Roles = "Read")]
    public ActionResult Index()
    {
        // 显示数据的逻辑
        return View();
    }
}

csharp
public class HomeController : Controller
{
    public ActionResult Create()
    {
        if (!User.IsInRole("Admin"))
        {
            return new HttpUnauthorizedResult();
        }
        // 创建操作的逻辑
        return View();
    }
    public ActionResult Index()
    {
        if (!User.IsInRole("User"))
        {
            return new HttpUnauthorizedResult();
        }
        // 显示数据的逻辑
        return View();
    }
}