asp.net webapi使用过滤器/filter实现用户禁用登录控制

/// <summary>
    /// 锁定账户的检查
    /// </summary>
    public class LockAccountAttribute : ActionFilterAttribute
    {
        public override void OnActionExecuting(HttpActionContext actionContext)
        {
            Base_UsersDTO userinfo = null;
            string actionName = actionContext.ActionDescriptor.ActionName;
            if (actionName.ToLower() == "login")
            {
                var args = actionContext.ActionArguments;
                var userLoginDTO = args["userlogin"] as UserLoginDTO;
                if (userLoginDTO != null)
                {
                    userinfo = new Base_UsersBLL().GetUserInfo(userLoginDTO.UserAccount).ToDto<Base_Users, Base_UsersDTO>();
                }
            }
            else
            {
                IEnumerable<string> tokenlist;
                if (actionContext.Request.Headers.TryGetValues("x-token", out tokenlist))
                {
                    Object obj = actionContext.Request.Content.ReadAsStreamAsync();
                    string token = tokenlist.FirstOrDefault();
                    var token_obj = CacheHelper.Get(token);
                    userinfo = JsonConvert.DeserializeObject<Base_UsersDTO>(token_obj.ToString());
                }
            }

            if (userinfo != null)
            {
                var user_LockBLL = new User_LockBLL();
                string memberID = userinfo.UserID;

                if (userinfo.UserType == SettleAccountType.merchant.GetStringValue())//如果是商家或者服务商,会有全组织下禁用
                {
                    memberID = userinfo.MerchantID;
                }
                else if (userinfo.UserType == SettleAccountType.isv.GetStringValue())
                {
                    memberID = userinfo.OrganizationID;
                }

                var lockSettleAccountInfo = user_LockBLL.IsLock(userinfo.UserType.ToEnum<SettleAccountType>(), memberID, LockEvent.Account);
                if (lockSettleAccountInfo.Status == true)
                {
                    actionContext.Response = new HttpResponseMessage
                    {
                        Content = new StringContent(JsonConvert.SerializeObject(new
                        {
                            statusCode = 0,
                            message = "账户已禁用",
                        }), System.Text.Encoding.GetEncoding("UTF-8"), "application/json"),
                        StatusCode = HttpStatusCode.OK
                    };
                }

                if (userinfo.UserType == SettleAccountType.merchant.GetStringValue() || userinfo.UserType == SettleAccountType.isv.GetStringValue())//如果是商家或者服务商,可以独立禁用员工
                {
                    var lockUserInfo = user_LockBLL.IsLock(userinfo.UserType.ToEnum<SettleAccountType>(), userinfo.UserID, LockEvent.Account);
                    if (lockUserInfo.Status == true)
                    {
                        actionContext.Response = new HttpResponseMessage
                        {
                            Content = new StringContent(JsonConvert.SerializeObject(new
                            {
                                statusCode = 0,
                                message = "账户已禁用",
                            }), System.Text.Encoding.GetEncoding("UTF-8"), "application/json"),
                            StatusCode = HttpStatusCode.OK
                        };
                    }
                }
            }
            else
            {
                actionContext.Response = new HttpResponseMessage
                {
                    Content = new StringContent(JsonConvert.SerializeObject(new
                    {
                        statusCode = 0,
                        message = "未找到用户信息",
                    }), System.Text.Encoding.GetEncoding("UTF-8"), "application/json"),
                    StatusCode = HttpStatusCode.OK
                };
            }

        }
    }