ASP.NET MVC 5中属性授权：Enrollment类Grade字段角色权限控制

嘿，我来帮你搞定这个Grade属性的角色授权控制问题！先看你给出的Enrollment类代码：

namespace School.Models {
    public enum Grade { A, B, C, D, F }
    public class Enrollment {
        public int EnrollmentID { get; set; }
        public int CourseID { get; set; }
        public int StudentID { get; set; }
        public Grade Grade { get; set; }
        public virtual Course Course { get; set; }
        public virtual Student Student { get; set; }
    }
}

假设你想要的是Admin角色用户可以修改Grade值，普通User角色只能查看不能修改，下面给你几种实用的实现方式：

1. 控制器层面：控制Grade属性的更新逻辑 #

在处理Enrollment编辑的POST动作里，我们可以判断当前用户的角色，只有Admin才允许更新Grade字段，普通用户提交的Grade值会被忽略，保留原有数据：

[HttpPost]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Edit(int id, Enrollment enrollment)
{
    if (id != enrollment.EnrollmentID)
    {
        return NotFound();
    }

    if (ModelState.IsValid)
    {
        var existingEnrollment = await _context.Enrollments.FindAsync(id);
        if (existingEnrollment == null)
        {
            return NotFound();
        }

        // 同步其他允许修改的属性
        existingEnrollment.CourseID = enrollment.CourseID;
        existingEnrollment.StudentID = enrollment.StudentID;

        // 仅Admin角色可修改Grade
        if (User.IsInRole("Admin"))
        {
            existingEnrollment.Grade = enrollment.Grade;
        }

        try
        {
            _context.Update(existingEnrollment);
            await _context.SaveChangesAsync();
        }
        catch (DbUpdateConcurrencyException)
        {
            if (!EnrollmentExists(enrollment.EnrollmentID))
            {
                return NotFound();
            }
            else
            {
                throw;
            }
        }
        return RedirectToAction(nameof(Index));
    }
    // 填充下拉框数据
    ViewData["CourseID"] = new SelectList(_context.Courses, "CourseID", "Title", enrollment.CourseID);
    ViewData["StudentID"] = new SelectList(_context.Students, "StudentID", "FullName", enrollment.StudentID);
    return View(enrollment);
}

2. 视图层面：根据角色显示不同的控件 #

为了提升用户体验，我们可以在编辑视图里，给Admin显示可编辑的下拉框，给普通User只显示Grade的文本值（同时隐藏一个保留原值的隐藏域，避免提交时丢失数据）：

<div class="form-group">
    <label asp-for="Grade" class="control-label"></label>
    @if (User.IsInRole("Admin"))
    {
        <!-- Admin看到可编辑的下拉框 -->
        <select asp-for="Grade" class="form-control" asp-items="Html.GetEnumSelectList<School.Models.Grade>()"></select>
    }
    else
    {
        <!-- 普通User只能查看文本 -->
        <p class="form-control-plaintext">@Html.DisplayFor(model => model.Grade)</p>
        <input type="hidden" asp-for="Grade" />
    }
    <span asp-validation-for="Grade" class="text-danger"></span>
</div>

3. 进阶：用授权策略统一控制 #

如果你的项目里有多处需要Admin权限的操作，可以先定义一个Admin专属的授权策略，然后在需要的地方使用：

首先在Program.cs（或Startup.cs）中配置策略：

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("RequireAdminRole", policy =>
        policy.RequireRole("Admin"));
});

然后在控制器动作上直接应用这个策略（如果某个页面只有Admin能访问编辑）：

[Authorize(Policy = "RequireAdminRole")]
public IActionResult Edit(int? id)
{
    // 编辑页面逻辑
}

或者在服务层的更新方法中加入角色校验，把授权逻辑从控制器抽离出来，让代码更整洁：

public async Task UpdateEnrollmentAsync(Enrollment updatedEnrollment, ClaimsPrincipal currentUser)
{
    var existingEnrollment = await _context.Enrollments.FindAsync(updatedEnrollment.EnrollmentID);
    if (existingEnrollment == null)
    {
        throw new InvalidOperationException("找不到对应的选课记录");
    }

    existingEnrollment.CourseID = updatedEnrollment.CourseID;
    existingEnrollment.StudentID = updatedEnrollment.StudentID;

    // 仅Admin可修改Grade
    if (currentUser.IsInRole("Admin"))
    {
        existingEnrollment.Grade = updatedEnrollment.Grade;
    }

    _context.Update(existingEnrollment);
    await _context.SaveChangesAsync();
}

内容的提问来源于stack exchange，提问作者Yoshi