c# - ASP.NET MVC 4 Custom Role Authorization show/hide Edit/Delete links in Views -

i want show/hide edit/delete links (including menu items) depending on user's authorization. have implemented authorizeattribute , have custom logic roles checking in overriden authorizecore. use logic when checking whether user has permissions view edit/delete links inside linkextensions method. setup:

public class authorizeactivity : authorizeattribute {     public override void onauthorization(authorizationcontext filtercontext)     {         base.onauthorization(filtercontext);     }      protected override bool authorizecore(system.web.httpcontextbase httpcontext)     {         bool isauthorized = base.authorizecore(httpcontext);         string actiontype = httpcontext.request.httpmethod;          string controller = httpcontext.request.requestcontext.routedata.values["controller"].tostring();         string action = httpcontext.request.requestcontext.routedata.values["action"].tostring();          //admins         if (controller == "admin")         {             if (httpcontext.user.isinrole(constants.admin))                 return true;         }         else         {             //data readers             if ((action == "details") || (action == "index"))             {                 if (httpcontext.user.isinrole(constants.datareader))                     return true;             }             //data writers &             else             {               ...             }         }         return false;     } 

also used vivien chevallier's logic creating authorized action link extension outlined here: http://vivien-chevallier.com/articles/create-an-authorized-action-link-extension-for-aspnet-mvc-3 in view can use:

<li>@html.actionlinkauthorized("admin", "index", "admin",false) </li> 

and link either show or not depending on user's rights. in controller action decorated with:

    [authorizeactivity]     public actionresult index()     {         return view(view);     } 

the authorized link not work unless specify 'roles' in attribute believe redundant, so:

[authorizeactivity(roles = constants.rolesalescontractadmin)] public actionresult index() {     return view(view); } 

i cant seem find way reuse logic in authorizeattribute. ideally called in actionlinkauthorized vivien's have it:

public static mvchtmlstring actionlinkauthorized(this htmlhelper htmlhelper, string linktext, string actionname, string controllername, routevaluedictionary routevalues, idictionary<string, object> htmlattributes, bool showactionlinkasdisabled)     {         if (htmlhelper.actionauthorized(actionname, controllername)) //the call verify here -- or inside actionauthorized         {             return htmlhelper.actionlink(linktext, actionname, controllername, routevalues, htmlattributes);         }         else         {             if (showactionlinkasdisabled)             {                 tagbuilder tagbuilder = new tagbuilder("span");                 tagbuilder.innerhtml = linktext;                 return mvchtmlstring.create(tagbuilder.tostring());             }             else             {                 return mvchtmlstring.empty;             }         }     } 

this actionauthorized method. onauthorization call not go customized one

public static bool actionauthorized(this htmlhelper htmlhelper, string actionname, string controllername)     {         controllerbase controllerbase = string.isnullorempty(controllername) ? htmlhelper.viewcontext.controller : htmlhelper.getcontrollerbyname(controllername);         controllercontext controllercontext = new controllercontext(htmlhelper.viewcontext.requestcontext, controllerbase);         controllerdescriptor controllerdescriptor = new reflectedcontrollerdescriptor(controllercontext.controller.gettype());         actiondescriptor actiondescriptor = controllerdescriptor.findaction(controllercontext, actionname);          if (actiondescriptor == null)             return false;         filterinfo filters = new filterinfo(filterproviders.providers.getfilters(controllercontext, actiondescriptor));          authorizationcontext authorizationcontext = new authorizationcontext(controllercontext, actiondescriptor);         foreach (iauthorizationfilter authorizationfilter in filters.authorizationfilters)         {             authorizationfilter.onauthorization(authorizationcontext); //this call             if (authorizationcontext.result != null)                 return false;         }         return true;     } 

in view, can write:

@if (user.isinrole("role")) {     <li>@html.actionlink("words", "view", "controller")</li>     <li>@html.actionlink("words", "view", "controller")</li> } 

... , assuming they're logged in, conditionally hide links