How to share code between MVC controllers that needs current user information?

Question

I have more than one controller that needs to check if a user has permission to view a information. This is my validation method.

private bool UserOnProject(Project project)
        {
            var userId = User.Identity.GetUserId();

            //check if developer is on project
            if (User.IsInRole(RoleNames.Developer))
            {
                var ProjDev = db.ProjectDevelopers.SingleOrDefault(model => model.ProjectId == project.Id
                && model.DeveloperId == userId);

                if (ProjDev == null)
                    return false;
            }

            //check if manager is over project
            else if (User.IsInRole(RoleNames.ProjectManager) && project.ManagerId != userId)
                return false;

            //user on project or admin
            return true;
        }

This needs to be called when the user views a Project details page or if the user views an Issues detail page where the issue belongs to a certain project. I tried moving this into its own class but then I can no longer use the User.Identity.GetUserId(). So I resorted to placing this function in both controllers but that is obviously is not what I want. Where/how can I place this so that I only need one copy of this and similar functions?

Is this in Microsoft.AspNetCore.Http.Abstractions? if so, will it work for MVC 5? and finally should I additionally pass a reference to the db? — Kevin Smeeks, Mar 28 '20 at 12:56
Ok hold on I did not realise you were not using Core. I'll find the links for the how to do it in MVC5 — Nkosi, Mar 28 '20 at 12:57
I updated the link https://stackoverflow.com/a/45908900/5233410 — Nkosi, Mar 28 '20 at 12:59
https://stackoverflow.com/questions/5898170/how-to-get-user-identity-working-outside-controller — Jerdine Sabio, Mar 28 '20 at 12:59
`if (!SharedFunctions.UserOnProject(this.HttpContext, db, project)) return HttpNotFound();` — Kevin Smeeks, Mar 28 '20 at 13:45

How to share code between MVC controllers that needs current user information?

0 Answers0