We have an MVC application that has very granular and configurable authorization. We currently have been using the authorize attribute against our controllers and controller functions.
The next project that we will be working on will require us to support a 3 state control. The 3 states are NoAccess, ReadAccess and FullAccess. NoAccess will require no control to be rendered, ReadAccess requires to render a label and FullAccess will render a control (textbox, dropdown, etc.)
Our first working approach was to add a dictionary to the model that contains a key identitfying the property and the value of what access the user has to said property.
This item would then be passed into an html extension.
@html.TextboxFor(m => m.FirstName, Model.AccessDictionary["FirstName"])
The extension would then render according to the access level. NoAccess would render a hidden, ReadAccess would render a label and a hidden, FullAccess would render a Textbox.
The second approach would be to decorate the model property with an attribute that would have the specify the key and in the textboxfor extension we would check the attributes and verify the access against the httpContext of the logged in user. This second approach would not work for our create or save buttons as these are not tied into the model.
I have searched online for some examples of complex configuration of views and models but have not come across anything as of yet. As mentioned above the first approach is currently working but it does not feel very elegant as each developer requires to populate a dictionary on every model and the view has lots of hiddens on that could lead to malicious updates. Any advice or direction would be much appreciated.