如何检查当前用户是否拥有控制器操作列表的访问权限

场景说明 #

你有一组控制器操作列表（如AController.BAction、AController.CAction等），需要通过authorizationService.AuthorizeAsync判断用户是否拥有这些操作的权限，以此决定是否展示对应的菜单。

实现步骤 #

1. 拆分控制器与动作名称

首先把原始的操作字符串拆分成控制器（去掉Controller后缀）和动作名称：

// 示例操作列表
var actionStrings = new List<string>
{
    "AController.BAction",
    "AController.CAction",
    "BController.DAction",
    "BController.EAction"
};

// 转换为控制器-动作对
var actionPairs = actionStrings.Select(s =>
{
    var parts = s.Split('.');
    return new
    {
        ControllerName = parts[0].Replace("Controller", string.Empty),
        ActionName = parts[1]
    };
}).ToList();

2. 批量检查权限

注入IAuthorizationService和IHttpContextAccessor后，循环调用授权方法，收集每个操作的权限结果：

private readonly IAuthorizationService _authorizationService;
private readonly IHttpContextAccessor _httpContextAccessor;

// 构造函数注入依赖
public YourMenuService(IAuthorizationService authorizationService, IHttpContextAccessor httpContextAccessor)
{
    _authorizationService = authorizationService;
    _httpContextAccessor = httpContextAccessor;
}

public async Task<Dictionary<string, bool>> GetActionPermissions(List<(string Controller, string Action)> actions)
{
    var permissionResults = new Dictionary<string, bool>();
    var currentUser = _httpContextAccessor.HttpContext.User;

    foreach (var (controller, action) in actions)
    {
        // 创建动作授权需求，自动匹配控制器/动作上的[Authorize]规则
        var requirement = new ActionAuthorizationRequirement
        {
            ControllerName = controller,
            ActionName = action
        };

        var authResult = await _authorizationService.AuthorizeAsync(currentUser, null, requirement);
        permissionResults.Add($"{controller}Controller.{action}", authResult.Succeeded);
    }

    return permissionResults;
}

3. 处理权限结果

根据需求判断权限：

• 检查所有操作是否都有权限：

  var allAllowed = permissionResults.All(kv => kv.Value);
  

• 筛选出用户有权限的操作：

  var allowedActions = permissionResults.Where(kv => kv.Value).Select(kv => kv.Key).ToList();
  

4. 视图中直接使用（Razor示例）

如果是在视图里动态渲染菜单，可以直接注入服务并逐个检查：

@inject IAuthorizationService AuthorizationService
@inject IHttpContextAccessor HttpContextAccessor

<ul class="menu">
    @{
        var menuActions = new List<string> { "AController.BAction", "AController.CAction" };
        var user = HttpContextAccessor.HttpContext.User;
    }

    @foreach (var actionStr in menuActions)
    {
        var parts = actionStr.Split('.');
        var controller = parts[0].Replace("Controller", "");
        var action = parts[1];

        var requirement = new ActionAuthorizationRequirement { ControllerName = controller, ActionName = action };
        var result = await AuthorizationService.AuthorizeAsync(user, null, requirement);

        if (result.Succeeded)
        {
            <li><a asp-controller="@controller" asp-action="@action">@actionStr</a></li>
        }
    }
</ul>

注意事项 #

• 控制器名称必须去掉Controller后缀，ActionAuthorizationRequirement要求的是路由中使用的控制器名称（不带后缀）。
• 该方法会自动识别控制器/动作上的[Authorize]、[Authorize(Roles="...")]或[Authorize(Policy="...")]属性，无需额外配置。

内容的提问来源于stack exchange，提问作者Imran Qadir Baksh - Baloch