C# WinForms登录表单：如何全局存储用户权限信息？

Hey there! Let’s work through this problem together. You’re smart to avoid relying on static or global variables—they can introduce hidden state issues and make your code harder to test and maintain. Below are some optimized, industry-standard approaches to share user permissions across your WinForms application, plus key improvements to your existing code.

First: Fixes to Your Current Login Class #

Before jumping into permission sharing, let’s clean up your Login class to follow best practices:

• Database Resource Management: Always use using blocks for SqlConnection, SqlCommand, and SqlDataReader—they automatically dispose resources even if an error occurs.
• Avoid AddWithValue: It can cause performance issues and type mismatches; use SqlParameter with explicit SqlDbType instead.
• Password Security: Never store or compare plain-text passwords. Ensure your database stores hashed passwords (use libraries like BCrypt.Net-Next), and hash the input password before comparing.
• Unused Code: Your ClearText method doesn’t work (parameters are passed by value, so it doesn’t modify the original strings) and can be removed.

Here’s the revised Login class (renamed to LoginService to better reflect its role):

public class LoginService
{
    public UserContext ValidateUser(string username, string password)
    {
        if (string.IsNullOrEmpty(username))
        {
            MessageBox.Show("Enter the user name!");
            return null;
        }

        // Hash the password here (match hashing method used in your database)
        // string hashedPassword = BCrypt.Net.BCrypt.HashPassword(password);

        using (SqlConnection sqlConn = new SqlConnection(ConnectionStrings.connNameUser))
        {
            sqlConn.Open();
            using (SqlCommand sqlCmd = new SqlCommand(
                "SELECT username, door_order_admin, super_user FROM dbo.[user] WHERE username = @user AND password = @pass", 
                sqlConn))
            {
                sqlCmd.Parameters.Add("@user", SqlDbType.VarChar, 50).Value = username;
                sqlCmd.Parameters.Add("@pass", SqlDbType.VarChar, 100).Value = password; // Replace with hashed password

                using (SqlDataReader reader = sqlCmd.ExecuteReader())
                {
                    if (reader.Read())
                    {
                        return new UserContext
                        {
                            Username = username,
                            IsAdmin = Convert.ToInt16(reader["door_order_admin"]) == 1,
                            IsTeamLeader = Convert.ToInt16(reader["super_user"]) == 1
                        };
                    }
                    else
                    {
                        MessageBox.Show("Log in failed please try again!");
                        return null;
                    }
                }
            }
        }
    }
}

// Dedicated class to hold user data and permissions
public class UserContext
{
    public string Username { get; set; }
    public bool IsAdmin { get; set; }
    public bool IsTeamLeader { get; set; }
}

Recommended Approaches to Share User Permissions #

1. Pass UserContext Directly to the Main Form #

This is the simplest, most explicit approach—no hidden state, easy to test.

• Modify your main form to accept a UserContext in its constructor.
• After successful login, pass the validated UserContext to the main form.

Revised frmLogin code:

public partial class frmLogin : Form
{
    public frmLogin()
    {
        InitializeComponent();
    }

    private void btnLogin_Click(object sender, EventArgs e)
    {
        string userName = txtUsername.Text;
        string passWord = txtPassword.Text;

        var loginService = new LoginService();
        var userContext = loginService.ValidateUser(userName, passWord);

        if (userContext != null)
        {
            using (frmMainMenu form = new frmMainMenu(userContext))
            {
                this.Hide();
                form.ShowDialog();
            }
            this.Close();
        }
    }
}

Main form (frmMainMenu) code:

public partial class frmMainMenu : Form
{
    private readonly UserContext _currentUser;

    // Accept UserContext via constructor
    public frmMainMenu(UserContext currentUser)
    {
        InitializeComponent();
        _currentUser = currentUser;

        // Use permissions to enable/disable controls immediately
        btnAdminPanel.Enabled = _currentUser.IsAdmin;
        btnTeamLeaderTools.Enabled = _currentUser.IsTeamLeader;
    }

    // Example usage in a button click
    private void btnAdminPanel_Click(object sender, EventArgs e)
    {
        if (_currentUser.IsAdmin)
        {
            // Open admin panel logic here
        }
    }
}

2. Thread-Safe Singleton User Session #

If you need access to user permissions across many forms without passing them around, a thread-safe singleton is a better alternative to global variables. It centralizes user state but keeps it controlled.

public sealed class UserSession
{
    // Thread-safe singleton instance
    private static readonly Lazy<UserSession> _instance = new Lazy<UserSession>(() => new UserSession());
    public static UserSession Instance => _instance.Value;

    // Private constructor to prevent external instantiation
    private UserSession() { }

    // User context property to hold session data
    public UserContext CurrentUser { get; set; }

    // Clear session on logout
    public void Logout()
    {
        CurrentUser = null;
    }
}

Update your login logic to set the session:

private void btnLogin_Click(object sender, EventArgs e)
{
    string userName = txtUsername.Text;
    string passWord = txtPassword.Text;

    var loginService = new LoginService();
    var userContext = loginService.ValidateUser(userName, passWord);

    if (userContext != null)
    {
        UserSession.Instance.CurrentUser = userContext;
        using (frmMainMenu form = new frmMainMenu())
        {
            this.Hide();
            form.ShowDialog();
        }
        this.Close();
    }
}

Access permissions in any form:

// In frmMainMenu or any other form
private void btnAdminPanel_Click(object sender, EventArgs e)
{
    if (UserSession.Instance.CurrentUser?.IsAdmin == true)
    {
        // Open admin panel logic here
    }
}

3. Dependency Injection (DI) for Larger Applications #

For more complex apps with many forms and services, DI is the most scalable approach. It makes your code testable and decoupled. We’ll use Microsoft.Extensions.DependencyInjection (available via NuGet).

1. Set up DI in your Program.cs:

using Microsoft.Extensions.DependencyInjection;

static class Program
{
    [STAThread]
    static void Main()
    {
        Application.SetHighDpiMode(HighDpiMode.SystemAware);
        Application.EnableVisualStyles();
        Application.SetCompatibleTextRenderingDefault(false);

        // Configure DI container
        var services = new ServiceCollection();
        services.AddScoped<LoginService>();
        // Register UserContext as a singleton since it's tied to the current session
        services.AddSingleton<UserContext>();

        var serviceProvider = services.BuildServiceProvider();

        // Open login form with injected dependencies
        Application.Run(serviceProvider.GetRequiredService<frmLogin>());
    }
}

2. Inject UserContext into forms:

// frmLogin with DI
public partial class frmLogin : Form
{
    private readonly LoginService _loginService;
    private readonly UserContext _userContext;

    public frmLogin(LoginService loginService, UserContext userContext)
    {
        InitializeComponent();
        _loginService = loginService;
        _userContext = userContext;
    }

    private void btnLogin_Click(object sender, EventArgs e)
    {
        string userName = txtUsername.Text;
        string passWord = txtPassword.Text;

        var validatedUser = _loginService.ValidateUser(userName, passWord);

        if (validatedUser != null)
        {
            // Update the injected UserContext with validated data
            _userContext.Username = validatedUser.Username;
            _userContext.IsAdmin = validatedUser.IsAdmin;
            _userContext.IsTeamLeader = validatedUser.IsTeamLeader;

            using (var mainMenu = new frmMainMenu(_userContext))
            {
                this.Hide();
                mainMenu.ShowDialog();
            }
            this.Close();
        }
    }
}

Final Recommendations #

• Start with Approach 1 if your app is small to medium-sized—it’s simple and avoids over-engineering.
• Use Approach 2 if you need easy access to user permissions across many forms without constructor passing.
• Adopt Approach 3 if you’re building a larger app with multiple services and want to keep your code maintainable and testable.

内容的提问来源于stack exchange，提问作者Tomm Grother