title: Granular permissions with certain requirements for an MVC site
body: <p>I don't like the built in membership providers. I've decided to roll my own. I'm trying to come up with a good method for performing authorization at the action level. Here are the requirements that I'm <em>trying</em> to go by:</p>
  
  <ol>
  <li>Attribute usage - I like this since it controls at a very high level in the call stack and is a nice place to organize permissions.</li>
  <li>No magic strings - This is a reason why I'm straying away from the current role providers. I don't want to leave strings lying around that can't be easily renamed.</li>
  <li>Permissions should can be composed of <em>one</em> other permission. Example: <code>ReadWrite</code> has permission for <code>Read</code>. Just like or'ing with an enum.</li>
  </ol>
  
  <p>NOTE: Some think this set of requirements is too broad (see comments). I don't think so, I think they're fairly straightforward. </p>
  
  <p>The biggest showstopper is attribute usage. There can only be "constant expressions, typeof expressions or array creation expression of an attribute parameter type". </p>
  
  <p>I was thinking of perhaps having something like this to make operations have static access. Inside of the attribute, it would "convert" the int to the actual Permission or something...:</p>
  
  <pre><code>public static class Operations
  {
      public static class SectionA
      {
          public const int Read = 1;
          public const int ReadWrite = 2;
      }
  
      public static class SectionB
      {
          // ... and so on...
      }
  }
  </code></pre>
  
  <p>But it really limits composition. I'm sure you're thinking "why don't you go the enum route?" well I want to plan for things to change and don't want to limit to 32 (int) or 64 (long) operations and have to do a massive rewrite later (also in the db that's just ugly).</p>
  
  <p>Also, if there is a better alternative than attributes on actions/controllers, then I'm all ears for suggestions.</p>
  
  <p>EDIT: Also from <a href="https://stackoverflow.com/questions/1060760/what-to-do-when-bit-mask-flags-enum-gets-too-large">this post</a>, I've read about the <code>BitArray</code> class. It seems <em>kind of</em> ugly, especially with the arbitrary storage in the database.</p>