Accessing information in a partial view in an MVC application

Question

I'm writting a C# based MVC web application, that displays categories and subcategories of information.

So, I have the database setup with a Category Table, which relates to itself, for sub categories - this is all hooked up with Entity Framework, and works perfectly.

What I'm struggling with, is how to implement a permission system - I can do this quite easily using ViewBag, but I'm wondering if the is a "proper" way to do this.

I have a view that looks like this:

@using Secure_Password_Repository.Utilities;
@using Secure_Password_Repository.Settings;
@using Secure_Password_Repository.ViewModels;
@model Secure_Password_Repository.ViewModels.CategoryDisplayItem

<ul id="roottree" class="treeview ui-accordion-content ui-helper-reset ui-widget-content ui-corner-bottom ui-accordion ui-widget ui-sortable ui-accordion-content-active">
    <li class="treeignore treeview ui-accordion ui-widget ui-helper-reset ui-sortable" data-id="0">
    <div><i class="glyphicon glyphicon-folder-open rightfolderpadding"></i>Root</div>
    <ul class="treeview ui-accordion-content ui-helper-reset ui-widget-content ui-corner-bottom ui-accordion ui-widget ui-sortable ui-accordion-content-active" id="parent-1">
        @foreach (var categoryitem in Model.categoryListItem.SubCategories)
        {
        @Html.Partial("_CategoryItem", categoryitem)
        }
        @if (Model.CanAddCategories)
        {
        @Html.Partial("_CreateCategory", Model.categoryAddItem)
        }
    </ul>
    </li>
</ul>

The CategorDisplayItem Model looks like this:

public class CategoryDisplayItem
{
    public CategoryItem categoryListItem { get; set; }
    public CategoryAdd categoryAddItem { get; set; }
    public PasswordAdd passwordAddItem { get; set; }
    public bool CanAddCategories { get; set; }
    public bool CanEditCategories { get; set; }
}

public class CategoryItem : CategoryEdit
{
    [Required]
    public Int32 Category_ParentID { get; set; }
    public virtual ICollection<CategoryItem> SubCategories { get; set; }
    public virtual ICollection<PasswordItem> Passwords { get; set; }
    public bool CanEditCategory { get; set; }
    public bool CanDeleteCategory { get; set; }
}

public class CategoryEdit
{
    public Int32? CategoryId { get; set; }
    [Required]
    public string CategoryName { get; set; }
}

The issue I'm havingm is how to set the CanEditCategory and CanDeleteCategory property for the CategoryItem view model. The permission is not set per category, it is set globally ie if my account has permission to edit categories, it has access to edit all categories.

The CategoryItem model is populated view Entity Framework:

        Category ReturnCategoryItem = DatabaseContext.Categories
                                        .Where(c => c.CategoryId == categoryid)
                                        .Include(c => c.SubCategories)
                                        .Include(c => c.Passwords)
                                        .Include(c => c.Passwords.Select(p => p.Creator))
                                        .ToList()
                                        .Select(c => new Category()
                                        {

                                            SubCategories = c.SubCategories
                                                                //make sure only undeleted subcategories are returned
                                                                .Where(sub => !sub.Deleted)
                                                                .OrderBy(sub => sub.CategoryOrder)
                                                                .ToList(),

                                            Passwords = c.Passwords
                                                                //make sure only undeleted passwords - that the current user has acccess to - are returned
                                                                .Where(pass => !pass.Deleted && PermissionService.CanViewPassword(pass)) 
                                                                .OrderBy(pass => pass.PasswordOrder)
                                                                .ToList(),

                                            CategoryId = c.CategoryId,
                                            CategoryName = c.CategoryName,
                                            Category_ParentID = c.Category_ParentID,
                                            CategoryOrder = c.CategoryOrder,
                                            Parent_Category = c.Parent_Category,
                                            Deleted = c.Deleted
                                        })
                                        .SingleOrDefault();

The SubCategories "Category" list gets casted to a "CategoryItem" list implicitly. So how would I set the CanEditCategories and CanDeleteCategories property?

Like I say, I could just use the ViewBag... but everything I read says that using the ViewBag is bad.

Answer 1

If these are properties that are unique to each user, you can add those properties to your Identity, then use them like this in your view:

At the top of your view cshtml file:

@using Microsoft.AspNet.Identity

Then access your User Name using the following syntax:

@if (@User.Identity.CanAddCategories())
{
  @Html.Partial("_CreateCategory", Model.categoryAddItem)
}