Several of my controller actions have a standard set of failure-handling behavior. In general, I want to:
- Load an object based on the Route Data (IDs and the like)
- If the Route Data does not point to a valid object (ex: through URL hacking) then inform the user of the problem and return an HTTP 404 Not Found
- Validate that the current user has the proper permissions on the object
- If the user doesn't have permission, inform the user of the problem and return an HTTP 403 Forbidden
- If the above is successful, then do something with that object that's action-specific (ie: render it in a view).
These steps are so standardized that I want to have reusable code to implement the behavior.
My current plan of attack was to have a helper method to do something like this:
public static ActionResult HandleMyObject(this Controller controller,
Func<MyObject,ActionResult> onSuccess) {
var myObject = MyObject.LoadFrom(controller.RouteData).
if ( myObject == null ) return NotFound(controller);
if ( myObject.IsNotAllowed(controller.User)) return NotAllowed(controller);
return onSuccess(myObject);
}
# NotAllowed() is pretty much the same as this
public static NotFound(Controller controller){
controller.HttpContext.Response.StatusCode = 404
# NotFound.aspx is a shared view.
ViewResult result = controller.View("NotFound");
return result;
}
The problem here is that Controller.View() is a protected method and so is not accessible from a helper. I've looked at creating a new ViewResult instance explicitly, but there's enough properties to set that I'm wary about doing so without knowing the pitfalls first.
What's the best way to create a ViewResult from outside a particular Controller?