How to capture the Exception generated by a method whose access is not authorized by a particular user profile

Question

How can I send the user a message that the operation he wants to do is not authorized?

I have in my View a button that calls a Javascript function

 <button id="btninicio" onclick="salvaApontamento();">Inicio</button>

That function salvaApontamento() calls a method in my Controller:

function salvaApontamento()
{
    startSpin();
    $.ajax({
        type: "POST",
        url: getBaseUrl() + "/Apontamentos/AlteraApontamento";,
        dataType: "json",
        data: JSON.stringify({ apontamentos: jsonDataApontamentos }),
        contentType: "application/json; charset=utf-8",
        cache: false,
        success: function (data) {
            stopSpin();
            alert("Sucesso);

        },
        error: function (data) {
            stopSpin();
            alert("Erro: salvaApontamento() :(  " + data.message)           
        }
    });
}

I have a method in my controller that makes changes only if you are the logged in "Administrator":

 [HttpPost]
 [Authorize(Roles = "Administrador")]
 public JsonResult AlteraApontamento(ApontamentosOperacao apontamentos)
 {
    //faz o que eu preciso e retorna um Json...
 }

Debugging the code, I realized that if I log in as "Operator". When triggering the request, the return falls straight into the Ajax error and my request does not even arrive in the method there in Controller.

The "Administrator" and the "Operator" see the same View. I would like to send a message to the View that informs the user that their profile is not valid. What parameter I need to capture in my variable data, there in javascript to know that the method cannot be accessed by the logged in user?

Following the suggestion of friend Eduardo, when I get the statusCode in the ajax javascript, I get the code 200.

When the user is authorized, my data object returns the data I built there in the Controller method.

Answer 1

Tag statusCode in your javascript, as shown below:

$.ajax({
  ....
  statusCode: {
    405: function() {
      alert( "Você não temn permisão para...." );
    }
  }
  ....
});

The Controlller returns a "Method Not Allowed" error, represented by the HTTP 405 code. Treat it with the above code.

Answer 2

In your place, I would make my own authorization attribute with the ability to return a 403 or 405 error, depending on your goal:

public class MeuAuthorizeAttribute : AuthorizeAttribute 
{
    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext) 
    {
        if (filterContext.HttpContext.User.Identity.IsAuthenticated)
            filterContext.Result = new HttpStatusCodeResult(403);
        else
            filterContext.Result = new HttpUnauthorizedResult();
    } 
}

The use is identical:

[HttpPost]
[MeuAuthorize(Roles = "Administrador")]
public JsonResult AlteraApontamento(ApontamentosOperacao apontamentos)
{
   //faz o que eu preciso e retorna um Json...
}

And for the call from Ajax, the response of @Eduardofernandes takes good care.