Update: Authorize User Roles with Attribute

Avoid overriding the Context.User in the http pipeline.

Disco.Web.Extensions/Disco.Web.Extensions.csproj

@@ -45,7 +45,7 @@
     </Reference>
     <Reference Include="Newtonsoft.Json, Version=4.5.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
       <SpecificVersion>False</SpecificVersion>
-      <HintPath>..\packages\Newtonsoft.Json.5.0.4\lib\net45\Newtonsoft.Json.dll</HintPath>
+      <HintPath>..\packages\Newtonsoft.Json.5.0.5\lib\net45\Newtonsoft.Json.dll</HintPath>
     </Reference>
     <Reference Include="System" />
     <Reference Include="System.ComponentModel.DataAnnotations" />
@@ -95,6 +95,7 @@
     <Compile Include="DataModelExtension\DocumentTemplateExtensions.cs" />
     <Compile Include="DataModelExtension\JobSubTypeExtensions.cs" />
     <Compile Include="DataModelExtension\JobTypeExtensions.cs" />
+    <Compile Include="MvcExtensions\AuthorizeDiscoUsersAttribute.cs" />
     <Compile Include="MvcExtensions\Bundles\Bundle.cs" />
     <Compile Include="MvcExtensions\Bundles\BundleExtensions.cs" />
     <Compile Include="MvcExtensions\Bundles\BundleHandler.cs" />

Disco.Web.Extensions/MvcExtensions/AuthorizeDiscoUsersAttribute.cs

@@ -0,0 +1,41 @@
+using Disco.BI.UserBI;
+using Disco.Models.Repository;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using System.Web.Mvc;
+
+namespace Disco.Web
+{
+    public class AuthorizeDiscoUsersAttribute : AuthorizeAttribute
+    {
+        string[] authorizedTypes;
+
+        public AuthorizeDiscoUsersAttribute(params string[] AuthorizedUserTypes)
+        {
+            if (AuthorizedUserTypes == null)
+                throw new ArgumentNullException("AuthorizedUserTypes");
+            if (AuthorizedUserTypes.Length == 0)
+                throw new ArgumentOutOfRangeException("AuthorizedUserTypes", "At least one Authorized User Type must be specified");
+            
+            authorizedTypes = AuthorizedUserTypes;
+        }
+
+        protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext)
+        {
+            if (httpContext == null)
+            {
+                throw new ArgumentNullException("httpContext");
+            }
+
+            var DiscoUser = UserCache.CurrentUser;
+
+            if (DiscoUser != null && authorizedTypes.Contains(DiscoUser.Type))
+                return true;
+
+            return false;
+        }
+    }
+}

Disco.Web.Extensions/MvcExtensions/dbAdminController.cs

@@ -6,7 +6,7 @@ using System.Web.Mvc;
 
 namespace Disco.Web
 {
-    [Authorize(Roles = "Admin")]
+    [AuthorizeDiscoUsersAttribute(Disco.Models.Repository.User.Types.Admin)]
     public class dbAdminController : dbController
     {
     }

Disco.Web.Extensions/Properties/AssemblyInfo.cs

@@ -32,5 +32,5 @@ using System.Runtime.InteropServices;
 // You can specify all the values or you can default the Build and Revision Numbers 
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.2.0513.1423")]
-[assembly: AssemblyFileVersion("1.2.0513.1423")]
+[assembly: AssemblyVersion("1.2.0516.1911")]
+[assembly: AssemblyFileVersion("1.2.0516.1911")]

Disco.Web.Extensions/packages.config

@@ -5,6 +5,6 @@
   <package id="Microsoft.AspNet.Razor" version="2.0.20715.0" targetFramework="net45" />
   <package id="Microsoft.AspNet.WebPages" version="2.0.20710.0" targetFramework="net45" />
   <package id="Microsoft.Web.Infrastructure" version="1.0.0.0" targetFramework="net45" />
-  <package id="Newtonsoft.Json" version="5.0.4" targetFramework="net45" />
+  <package id="Newtonsoft.Json" version="5.0.5" targetFramework="net45" />
   <package id="WebActivatorEx" version="2.0.1" targetFramework="net45" />
 </packages>