“Security aware” action link?

Question

How can I create a \"security aware\" action link that detects if a user is authorized to click (invoke) the action?
Hide link if user is not allowed to use that action.

Answer 1

The Area part is a bit more complicated than just adding some overloads. The UseNamespaceFallback hack doesn't work because you will instantiate the wrong when you have identically named controllers in different Areas.

You need to have a way to get the correct namespace for the Area

otherwise this

 IController controller = factory.CreateController(helper.ViewContext.RequestContext, controllerName); 

Will go wrong.

Currently I have the links like this in the view

@Html.SecurityTrimmedActionLink("this link", "Index", "Home",new {Area=string.Empty});   
@Html.SecurityTrimmedActionLink("this link", "Index", "FunctionAdministration", new   {Area="Administration" }, null);

Inside

public static bool HasActionPermission(this HtmlHelper htmlHelper, string actionName, string controllerName, object area)

I will get the namespace for the area or the default namespace when area is empty.

private static string GetNamespaceForArea(string area, RouteCollection routeColl)
    {
        string ns = string.Empty;
        foreach (RouteBase routeBase in routeColl)
        {
            if (routeBase.GetType() == (typeof (Route)))
            {
                Route route = (Route) routeBase;
                RouteValueDictionary dataTokens = route.DataTokens;
                ;
                if (area != null)
                {
                    if (dataTokens.ContainsKey("area"))
                    {
                        if (area.Equals(dataTokens["area"]))
                        {
                            ns = (string) ((string[]) dataTokens["Namespaces"])[0];
                            break;
                        }
                    }
                    else
                    {
                        if (area.Equals(string.Empty))
                        {
                            ns = (string) ((string[]) dataTokens["Namespaces"])[0];
                            break;
                        }
                    }
                }
            }
        }
        return ns;
    }

You need to setup the default namespace in your route in globalasax for example like this (default ns "ActionLinkTest.Controllers"):

routes.MapRoute(
            "Default", // Route name
            "{controller}/{action}/{id}", // URL with parameters
            new { controller = "Home", action = "Index", id = UrlParameter.Optional } // Parameter defaults
            , new[] { "ActionLinkTest.Controllers" }
        );

use it to create the controller based on the type name:

ControllerBase controllerToLinkTo = string.IsNullOrEmpty(controllerName) ? htmlHelper.ViewContext.Controller :(ControllerBase) Activator.CreateInstance(Type.GetType(type));

in global.asax define the areas

areaRegistration.Add("Administration","Areas.Administration");