如何在ASP.NET MVC控制器中使用枚举作为策略授权参数？

1. 修正枚举定义以支持位运算 #

首先你的Policy枚举需要加上[Flags]特性，并调整值为2的幂次，这样才能正确支持位运算（如Policy.Admin | Policy.Owner表示同时需要两种权限）：

[Flags]
public enum Policy
{
    Admin = 1 << 0,  // 1
    Office = 1 << 1, // 2
    Teacher = 1 << 2,// 4
    Student = 1 << 3,// 8
    Owner = 1 << 4   // 16
}

2. 重构自定义授权属性 #

你当前的PolicyAuthorizeAttribute存在构造函数未赋值、未处理枚举到策略映射的问题，重构后如下：

[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, Inherited = true, AllowMultiple = true)]
public class PolicyAuthorizeAttribute : ResourceAuthorizeAttribute
{
    private readonly Policy _requiredPolicies;

    public PolicyAuthorizeAttribute(Policy requiredPolicies)
    {
        _requiredPolicies = requiredPolicies;
    }

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        if (!base.AuthorizeCore(httpContext))
            return false;

        // 获取OWIN上下文的授权服务
        var authorizationService = httpContext.GetOwinContext().GetAuthorizationService();
        var user = httpContext.User;

        // 拆分枚举中所有激活的权限标志
        var activePolicies = Enum.GetValues(typeof(Policy))
                                .Cast<Policy>()
                                .Where(p => _requiredPolicies.HasFlag(p) && p != 0);

        // 验证用户满足所有指定策略（逻辑与）
        foreach (var policy in activePolicies)
        {
            var policyName = policy.ToString();
            if (!authorizationService.AuthorizeAsync(user, policyName).Result)
            {
                return false;
            }
        }

        return true;
    }

    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        if (filterContext.HttpContext.Request.IsAuthenticated)
        {
            filterContext.Result = new HttpStatusCodeResult((int)HttpStatusCode.Forbidden);
        }
        else
        {
            base.HandleUnauthorizedRequest(filterContext);
        }
    }
}

3. 完成Owner策略的实现 #

Owner权限通常需要验证用户是资源的所有者，需要自定义授权需求和处理器：

定义Owner授权需求与处理器

// 授权需求标记
public class OwnerRequirement : IAuthorizationRequirement { }

// 所有者验证处理器
public class OwnerHandler : AuthorizationHandler<OwnerRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, OwnerRequirement requirement)
    {
        // 从授权上下文获取MVC路由信息（用于获取资源ID）
        var filterContext = context.Resource as AuthorizationFilterContext;
        if (filterContext == null)
        {
            context.Fail();
            return Task.CompletedTask;
        }

        // 从路由参数中获取资源ID（示例中路由参数为"id"）
        if (!filterContext.RouteData.Values.TryGetValue("id", out var idValue))
        {
            context.Fail();
            return Task.CompletedTask;
        }

        // 获取当前用户ID（需替换为你系统中实际的用户ID声明类型）
        var currentUserId = context.User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
        if (string.IsNullOrEmpty(currentUserId))
        {
            context.Fail();
            return Task.CompletedTask;
        }

        // 此处替换为实际的所有者校验逻辑（比如查询数据库验证资源所有者ID是否等于当前用户ID）
        if (currentUserId == idValue.ToString())
        {
            context.Succeed(requirement);
        }
        else
        {
            context.Fail();
        }

        return Task.CompletedTask;
    }
}

在Startup中注册Owner策略

更新Startup类，添加Owner策略并注册处理器：

public partial class Startup
{
    public void Configuration(IAppBuilder app)
    {
        ConfigureAuth(app);

        app.UseAuthorization(options =>
        {
            // 角色关联策略
            options.AddPolicy(Policy.Admin.ToString(), policy => policy.RequireRole(Rolle.Admin.ToString()));
            options.AddPolicy(Policy.Office.ToString(), policy => policy.RequireRole(Rolle.Office.ToString()));
            options.AddPolicy(Policy.Teacher.ToString(), policy => policy.RequireRole(Rolle.Teacher.ToString()));
            options.AddPolicy(Policy.Student.ToString(), policy => policy.RequireRole(Rolle.Student.ToString()));
            
            // Owner策略注册
            options.AddPolicy(Policy.Owner.ToString(), policy => 
                policy.Requirements.Add(new OwnerRequirement()));
            
            // 注册Owner授权处理器
            options.AddHandler<OwnerHandler>();
        });
    }
}

4. 使用示例 #

现在可以直接通过枚举位运算来指定所需权限：

// 需要同时具备Admin和Owner权限
[PolicyAuthorize(Policy.Admin | Policy.Owner)]
public ActionResult Edit(int id)
{
    // 编辑逻辑
    return View();
}

// 仅需Admin权限
[PolicyAuthorize(Policy.Admin)]
public ActionResult AdminDashboard()
{
    // 后台逻辑
    return View();
}

内容的提问来源于stack exchange，提问作者Mazzmax