aspnet/Mvc — pull request #1664 by HaoK (2014-12-03 18:22:42+00:00)
Title: Prototype MVC changes for current authorize design

cc @yishaigalatzer @rynowak @loudej @blowdart

Here's my take on what MVC changes would look like with the proposed auth changes so far:
- Replaced Permission claim concept with 2 policies: CanViewPage and CanViewAnything
- There was on test checking that NullPolicy would succeed, I don't fully grok what that was testing since we repurposed the policy name, so I just skipped it for now (my instinct was to flip that test around to ensure that UnknownPolicy FAILS instead)

Question:
- Do we still want Authorize to support effectively what would be an auto policy where its asking for a specific claim in the attribute? The design currently doesn't support that, but I don't think its that bad requiring all authorize checks to go through a policy configured in startup...