c# - limit functionality of user control based on the user role -

what best-practices and/or standards creating user control in asp.net mvc web applications ability limit functionality of it, based on user role or user itself?

in other words, assume have 4 different web pages 90% exact similar content (some search fields, grid containing result of search, javascript, ...) , each 1 may have 1 or 2 other search fields. (please note these search fields on each page, effective in result of search. please consider use same stored procedures behind scene, , in pages less search fields, pass null or default values -based on situation- them).

we looking way refactor our code , if it's possible use user control in each of 4 pages instead.

edit : maybe should correct question : how avoid putting <% if(...)%> tags inside view , use method 1 described here, crice said: "it better let viewdata or model represent view display, , view can check view data. controller base class or filter on action can make repetitive use of simple , allow code exist in 1 place." in order solve problem?

people keep emphasizing on check user-in-role part. in fact had knew when asked question. don't know how right way, using viewdata or model or whatever suits these kind of cases. (specially using model described in reference question)

thanks lot guiding me through , patience.

we looking way refactor our code , if it's possible use user control in each of 4 pages instead.

this right way indeed. except in asp.net mvc there no user/server side controls. write custom reusable html helper encapsulate function functionality , inside view call custom helper. example:

@html.rolebasedtextboxfor(x => x.somefield, "admin") 

the custom helper check if authenticated user in admin role , render textbox, if not return empty string.

here's how such sample helper like:

public static class htmlextensions { public static ihtmlstring rolebasedtextboxfor<tmodel, tproperty>( htmlhelper<tmodel> html, expression<func<tmodel, tproperty>> expression, string rolename ) { var user = html.viewcontext.httpcontext.user; if (!user.identity.isauthenticated || !user.isinrole(rolename)) { // user not authenticated or not in required role return mvchtmlstring.empty; } return html.textboxfor(expression); } }