title: IFilterProvider and separation of concerns
body: <p>I have a situation where I need to inject some dependencies in a action filter, namely, my custom authorization provider in my custom authorization attribute. I stumbled upon a lot of people and posts who were saying that we should be separating the 'attribute metadata' from the 'behavior'. This makes sense and there is also the fact that filter attributes are not instantiated through the 'DependencyResolver' so it is difficult to inject the dependencies.</p>
  
  <p>So I did a little refactoring of my code and I wanted to know if I had it right (I'm using Castle Windsor as the DI framework).</p>
  
  <p>First off I stripped my attribute to contain only the raw data I need</p>
  
  <pre><code>[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
  public class MyAuthorizeAttribute : Attribute
  {
      public string Code { get; set; }
  }
  </code></pre>
  
  <p>I created a custom authorization filter that would contain the logic of determining if the current user has the proper authorization</p>
  
  <pre><code>public class MyAuthorizationFilter : IAuthorizationFilter
  {
      private IAuthorizationProvider _authorizationProvider;
      private string _code;
  
      public MyAuthorizationFilter(IAuthorizationProvider authorizationProvider, string code)
      {
          Contract.Requires(authorizationProvider != null);
          Contract.Requires(!string.IsNullOrWhiteSpace(code));
  
          _authorizationProvider = authorizationProvider;
          _code = code;
      }
  
      public void OnAuthorization(AuthorizationContext filterContext)
      {
          if (filterContext == null)
          {
              throw new ArgumentNullException("filterContext");
          }
  
          if (filterContext.HttpContext.Request.IsAuthenticated)
          {
              BaseController controller = filterContext.Controller as BaseController;
              if (controller != null)
              {
                  if (!IsAuthorized(controller.CurrentUser, controller.GetCurrentSecurityContext()))
                  {
                      // forbidden
                      filterContext.RequestContext.HttpContext.Response.StatusCode = 403;
                      if (filterContext.RequestContext.HttpContext.Request.IsAjaxRequest())
                      {
                          filterContext.Result = new RedirectToRouteResult("default", new RouteValueDictionary(new
                          {
                              action = "http403",
                              controller = "error"
                          }), false);
                      }
                      else
                      {
                          filterContext.Result = controller.InvokeHttp404(filterContext.HttpContext);
                      }
                  }
              }
              else
              {
  
              }
          }
          else
          {
              filterContext.Result = new RedirectResult(FormsAuthentication.LoginUrl);
          }
      }
  
      private bool IsAuthorized(MyUser user, BaseSecurityContext securityContext)
      {
          bool has = false;
          if (_authorizationProvider != null &amp;&amp; !string.IsNullOrWhiteSpace(_code))
          {
              if (user != null)
              {
                  if (securityContext != null)
                  {
                      has = _authorizationProvider.HasPermission(user, _code, securityContext);
                  }
              }
          }
          else
          {
              has = true;
          }
          return has;
      }
  }
  </code></pre>
  
  <p>The last part was to create a custom filter provider that would fetch this specific attribute and instantiate my custom filter passing its dependencies and any data it needs, extracted from the attribute.</p>
  
  <pre><code>public class MyAuthorizationFilterProvider : IFilterProvider
  {
      private IWindsorContainer _container;
  
      public MyAuthorizationFilterProvider(IWindsorContainer container)
      {
          Contract.Requires(container != null);
          _container = container;
      }
  
      public IEnumerable&lt;Filter&gt; GetFilters(ControllerContext controllerContext, ActionDescriptor actionDescriptor)
      {
          Type controllerType = controllerContext.Controller.GetType();
          var authorizationProvider = _container.Resolve&lt;IAuthorizationProvider&gt;();
          foreach (MyAuthorizeAttribute attribute in controllerType.GetCustomAttributes(typeof(MyAuthorizeAttribute), false))
          {
              yield return new Filter(new MyAuthorizationFilter(authorizationProvider, attribute.Code), FilterScope.Controller, 0);
          }
          foreach (MyAuthorizeAttribute attribute in actionDescriptor.GetCustomAttributes(typeof(MyAuthorizeAttribute), false))
          {
              yield return new Filter(new MyAuthorizationFilter(authorizationProvider, attribute.Code), FilterScope.Action, 0);
          }
      }
  }
  </code></pre>
  
  <p>The last step is the register the filter provider in the global.asax</p>
  
  <pre><code>FilterProviders.Providers.Add(new MyAuthorizationFilterProvider(_container));
  </code></pre>
  
  <p>So I'm wondering first, if I got the idea right and second, what could be improved.</p>