1 public class YbApiAuthorizeAttribute : System.Web.Http.AuthorizeAttribute
  2     {
  3         private const string BasicAuthResponseHeader = "WWW-Authenticate";
  4         private const string BasicAuthResponseHeaderValue = "Basic";
  5         public string PermissionKey { get; set; }
  6         public override void OnAuthorization(HttpActionContext actionContext)
  7         {
  8             if (actionContext == null)
  9                 throw new ArgumentNullException("actionContext");
 10             if (AuthorizationDisabled(actionContext) || AuthorizeRequest(actionContext.ControllerContext.Request))
 11                 return;
 12             this.HandleUnauthorizedRequest(actionContext);
 13         }
 14
 15         protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
 16         {
 17             if (actionContext == null)
 18                 throw new ArgumentNullException("actionContext");
 19             actionContext.Response = CreateUnauthorizedResponse(actionContext.ControllerContext.Request);
 20         }
 21
 22         private HttpResponseMessage CreateUnauthorizedResponse(HttpRequestMessage request)
 23         {
 24             var result = new HttpResponseMessage()
 25                 {
 26                     StatusCode = HttpStatusCode.Unauthorized,
 27                     RequestMessage = request
 28                 };
 29             //we need to include WWW-Authenticate header in our response,
 30             //so our client knows we are using HTTP authentication
 31             result.Headers.Add(BasicAuthResponseHeader, BasicAuthResponseHeaderValue);
 32             return result;
 33         }
 34
 35         private static bool AuthorizationDisabled(HttpActionContext actionContext)
 36         {
 37             //support new AllowAnonymousAttribute
 38             if (!actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Any())
 39                 return actionContext.ControllerContext.ControllerDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Any();
 40             return true;
 41         }
 42
 43         private bool AuthorizeRequest(HttpRequestMessage request)
 44         {
 45             //匿名用户的权限验证
 46             if (!HttpContext.Current.User.Identity.IsAuthenticated)
 47             {
 48                 var permissionsOfEveryOne = Permissions.GetPermissionsInRole("EveryOne");
 49                 return CheckPermission(request, permissionsOfEveryOne);
 50             }
 51             //未设置权限Key，则任何用户均可访问
 52             if (string.IsNullOrWhiteSpace(PermissionKey)) return true;
 53
 54             //登录用户的权限验证
 55             var allowPermissions = Permissions.GetPermissionsForUser();
 56             return CheckPermission(request, allowPermissions);
 57         }
 58
 59         private bool CheckPermission(HttpRequestMessage request, Permission[] permissionsOfEveryOne)
 60         {
 61             if (permissionsOfEveryOne == null || permissionsOfEveryOne.Length == 0)
 62                 return false;
 63             var permissionKeys = permissionsOfEveryOne.Select(c => c.PermissionKey);
 64             if (request.Method.Method.Equals("GET", StringComparison.OrdinalIgnoreCase))
 65                 return permissionKeys.Contains(PermissionKey.ToLower());
 66             if (request.Method.Method.Equals("PUT", StringComparison.OrdinalIgnoreCase))
 67                 return permissionKeys.Contains(string.Format("{0}.add", PermissionKey.ToLower()));
 68             if (request.Method.Method.Equals("POST", StringComparison.OrdinalIgnoreCase))
 69                 return permissionKeys.Contains(string.Format("{0}.edit", PermissionKey.ToLower()));
 70             if (request.Method.Method.Equals("DELETE", StringComparison.OrdinalIgnoreCase))
 71                 return permissionKeys.Contains(string.Format("{0}.delete", PermissionKey.ToLower()));
 72             return false;
 73         }
 74
 75         protected string[] RolesSplit
 76         {
 77             get { return SplitStrings(Roles); }
 78         }
 79
 80         protected string[] UsersSplit
 81         {
 82             get { return SplitStrings(Users); }
 83         }
 84
 85         protected static string[] SplitStrings(string input)
 86         {
 87             if (string.IsNullOrWhiteSpace(input)) return new string[0];
 88             var result = input.Split(',').Where(s => !String.IsNullOrWhiteSpace(s.Trim()));
 89             return result.Select(s => s.Trim()).ToArray();
 90         }
 91
 92        /// <summary>
 93         /// Implement to include authentication logic and create IPrincipal
 94        /// </summary>
 95         protected bool TryCreatePrincipal(string user, string password, out IPrincipal principal)
 96         {
 97             principal = null;
 98             if (!Membership.ValidateUser(user, password))
 99                 return false;
100             string[] roles = System.Web.Security.Roles.Provider.GetRolesForUser(user);
101             principal = new GenericPrincipal(new GenericIdentity(user), roles);
102             return true;
103         }
104     }