title: WPF permission-based authorization using Enum Flag Bit
body: <p><em>I've been doing C# for a month now so please forgive the 'localness' to this question but I have researched for a few hours and I have hit a brick wall.</em></p>
  
  <p>I've seen examples left and right for <strong>Role-based authorization</strong> for WPF applications utilizing <code>IIdentity</code> and <code>IPrincipal</code>.</p>
  
  <p>I can't find a lot of information, however, on a more <strong>Permission-based authorization</strong> approach, in this app imagine there are no Groups but just a list of permissions and users and you can assign anyone any permission.</p>
  
  <p>I'd like to be able to:</p>
  
  <p>1) Be able to control the UI/elements based on user permissions with such states as: Enabled, ReadOnly, Invisible, Collapsed (as seen here <a href="https://uiauth.codeplex.com/" rel="nofollow noreferrer">https://uiauth.codeplex.com/</a>)<br>
  2) Be able to specify at the class or method level which permissions are required (similar to <a href="http://lostechies.com/derickbailey/2011/05/24/dont-do-role-based-authorization-checks-do-activity-based-checks/" rel="nofollow noreferrer">http://lostechies.com/derickbailey/2011/05/24/dont-do-role-based-authorization-checks-do-activity-based-checks/</a>)</p>
  
  <p>Instead of:</p>
  
  <p><code>[PrincipalPermission(SecurityAction.Demand, Role = "Administrators")]</code></p>
  
  <p>I want something like:</p>
  
  <p><code>[PrincipalPermission(SecurityAction.Demand, Permission = "Can add users")]</code></p>
  
  <p>Right now the only way I see how to do this is utilizing <code>ICommand</code> and putting authorization logic in the <code>CanExecute</code> methods using a lot of string comparison to see if the user has the required rights to perform requested actions like:</p>
  
  <pre><code>// Employee class
  public bool HasRight(SecurityRight right)
  {
      return employee.Permissions.Contains(right);
  }
  
  // Implementation, check if employee has right to continue
  if (employee.HasRight(db.SecurityRights.Single(sr =&gt; sr.Description == "Can edit users")))
  {
      // Allowed to perform action
  }
  else
  {
      // User does not have right to continue
      throw SecurityException;
  }
  </code></pre>
  
  <p>I've been told Enum Flags may be what I'm looking for <a href="https://stackoverflow.com/questions/8447/enum-flags-attribute/8462#8462">What does the [Flags] Enum Attribute mean in C#?</a></p>
  
  <p>I think I understand enum/flag/bits but not enough to complete the implementation...</p>
  
  <p>If I have:</p>
  
  <p>EmployeeModel<br>
  EmployeeViewModel<br>
  ThingTwoModel<br>
  ThingTwoViewModel<br>
  MainView  </p>
  
  <p>I'm not sure where everything goes and how to tie it all together.... here's what I have so far (I realize this isnt a working example... thats my problem!):</p>
  
  <pre><code>    [Flags]
      public enum Permissions
      {
          None = 0,
          Create = 1 &lt;&lt; 0,
          Read = 1 &lt;&lt; 1,
          Update = 1 &lt;&lt; 2,
          Delete = 1 &lt;&lt; 3,
  
          User = 1 &lt;&lt; 4,
          Group = 1 &lt;&lt; 5
      }
  
      public static void testFlag()
      {
          Permissions p;
          var x = p.HasFlag(Permissions.Update) &amp;&amp; p.HasFlag(Permissions.User);
          var desiredPermissions = Permissions.User | Permissions.Read | Permissions.Create;
          if (x &amp; p == desiredPermissions)
          {
              //the user can be created and read by this operator
          }
      }
  </code></pre>
  
  <p>Thank you for any guidance.</p>