UrlExtension for authorizing controllers and actions against a list of modules. Blog post at https://stefanolsen.com/posts/using-authorizeattribute-for-modules-in-a-multi-tenancy-web-platform/

AuthorizeModuleAttribute.cs

public class AuthorizeModuleAttribute : AuthorizeAttribute
{
    private readonly ModuleService _moduleService;

    public string ModuleKey { get; set; }

    public AuthorizeModuleAttribute()
    {
        _moduleService = new ModuleService();
    }

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        if (httpContext == null)
        {
            throw new ArgumentNullException(nameof(httpContext));
        }

        if (string.IsNullOrWhiteSpace(ModuleKey))
        {
            return false;
        }

        string customerId = UserContext.CustomerId;
        return customerId != null && _moduleService.HasEnabledModule(customerId, ModuleKey);
    }
}