MVC 3 - Limiting sections and/or controls of a View by Roles/Functions - asp.net-mvc-3

Question

I will have many Roles, and each Role has many functions, so the RequireRoles Attribute I don't think will suffice in my case. I need some way to dynamically let the Controller action define to the View what sections and/or controls in the View (without adding if/else logic inside the View).
My thought is that the Controller should be telling the View how to present itself and not the View with the if/else logic.
Any ideas on how to design this ?

Answer 1

You need to first of all create a filter which you can use an attribute to control what roles see what actions. See http://www.asp.net/mvc/tutorials/older-versions/controllers-and-routing/understanding-action-filters-cs.
public class RequiresRoleAttribute : ActionFilterAttribute {
private List<string> requiredRoles = null;
/// <summary>
/// Initializes a new instance of the <see cref="RequiresRoleAttribute"/> class.
/// </summary>
/// <param name="roleNames">The role names.</param>
public RequiresRoleAttribute(params string[] roleNames) {
this.requiredRoles = new List<string>(roleNames);
}
/// <summary>
/// Called by the MVC framework before the action method executes.
/// </summary>
/// <param name="filterContext">The filter context.</param>
public override void OnActionExecuting(ActionExecutingContext filterContext) {
bool hasRole = false;
// check to see if the user has the proper role here
// if the do not have the role, they are not allowed to execute the action
if (!hasRole)
throw new UserAccessException("You do not have access to this action (" + filterContext.ActionDescriptor.ActionName + ", " + filterContext.ActionDescriptor.ControllerDescriptor.ControllerName + ")");
base.OnActionExecuting(filterContext);
}
}
Second to solve your problem of no logic in the views you could use child actions for each section which requires a role. Again you could apply your filter to the child actions. For more on child actions see: http://msdn.microsoft.com/en-us/library/ie/ee839451.aspx.
What you would need to change is the section that throws the exception. You'd need to check to see if the action being executed is a child action. If so, you'd want to return an empty content result.