C# IPrincipal.HasAccessFor方法代码示例

		public List<string> GetVisibleUnits(string courseId, IPrincipal user)
		{
			var canSeeEverything = user.HasAccessFor(courseId, CourseRole.Tester);
			if (canSeeEverything)
				return courseManager.GetCourse(courseId).Slides.Select(s => s.Info.UnitName).Distinct().ToList();
			return db.Units.Where(u => u.CourseId == courseId && u.PublishTime <= DateTime.Now).Select(u => u.UnitName).ToList();
		}

		private bool CanAddCommentHere(IPrincipal user, string courseId, bool isReply)
		{
			if (!User.Identity.IsAuthenticated)
				return false;

			var commentsPolicy = commentsRepo.GetCommentsPolicy(courseId);
			var isInstructor = user.HasAccessFor(courseId, CourseRole.Instructor);

			if (!isInstructor && !commentsPolicy.IsCommentsEnabled)
				return false;

			if (isReply && !isInstructor && commentsPolicy.OnlyInstructorsCanReply)
				return false;

			return true;
		}

		public async Task<Comment> AddComment(IPrincipal author, string courseId, Guid slideId, int parentCommentId, string commentText)
		{
			var commentsPolicy = GetCommentsPolicy(courseId);
			var isInstructor = author.HasAccessFor(courseId, CourseRole.Instructor);
			var isApproved = commentsPolicy.ModerationPolicy == CommentModerationPolicy.Postmoderation || isInstructor;

			/* Instructors' replies are automaticly correct */
			var isReply = parentCommentId != -1;
			var isCorrectAnswer = isReply && isInstructor;

			var comment = db.Comments.Create();
			comment.AuthorId = author.Identity.GetUserId();
			comment.CourseId = courseId;
			comment.SlideId = slideId;
			comment.ParentCommentId = parentCommentId;
			comment.Text = commentText;
			comment.IsApproved = isApproved;
			comment.IsCorrectAnswer = isCorrectAnswer;
			comment.PublishTime = DateTime.Now;
			db.Comments.Add(comment);
			await db.SaveChangesAsync();

			return db.Comments.Find(comment.Id);
		}

		private bool CanAddCommentNow(IPrincipal user, string courseId)
		{
			// Instructors have unlimited comments
			if (user.HasAccessFor(courseId, CourseRole.Instructor))
				return true;

			var commentsPolicy = commentsRepo.GetCommentsPolicy(courseId);
			return ! commentsRepo.IsUserAddedMaxCommentsInLastTime(user.Identity.GetUserId(),
				commentsPolicy.MaxCommentsCountInLastTime,
				commentsPolicy.LastTimeForMaxCommentsLimit);
		}

		private bool CanEditAndDeleteComment(IPrincipal user, Comment comment)
		{
			return user.HasAccessFor(comment.CourseId, CourseRole.Instructor) ||
					user.Identity.GetUserId() == comment.AuthorId;
		}

		public bool CanUserSeeAllCourseGroups(IPrincipal user, string courseId)
		{
			return user.HasAccessFor(courseId, CourseRole.CourseAdmin);
		}

		public List<Group> GetAvailableForUserGroups(string courseId, IPrincipal user)
		{
			if (!user.HasAccessFor(courseId, CourseRole.Instructor))
				return new List<Group>();

			IEnumerable<Group> groups;
			var userId = user.Identity.GetUserId();

			/* Course admins can see all groups */
			if (CanUserSeeAllCourseGroups(user, courseId))
				groups = GetGroups(courseId);
			else
				/* Other instructor can see only public or own groups */
				groups = db.Groups.Where(g => g.CourseId == courseId && !g.IsDeleted && (g.OwnerId == userId || g.IsPublic));
			
			return groups
				.OrderBy(g => g.OwnerId != userId)
				.ThenBy(g => g.Name)
				.ToList();
		}

		public bool IsGroupAvailableForUser(int groupId, IPrincipal user)
		{
			var group = FindGroupById(groupId);
			/* Course admins can see all groups */
			if (CanUserSeeAllCourseGroups(user, group.CourseId))
				return true;

			if (!user.HasAccessFor(group.CourseId, CourseRole.Instructor))
				return false;

			var userId = user.Identity.GetUserId();
			return !group.IsDeleted && (group.OwnerId == userId || group.IsPublic);
		}