Several of my controller actions have a standard set of failure-handling behavior. In general, I want to:

• Load an object based on the Route Data (IDs and the like)
  • If the Route Data does not point to a valid object (ex: through URL hacking) then inform the user of the problem and return an HTTP 404 Not Found
• Validate that the current user has the proper permissions on the object
  • If the user doesn't have permission, inform the user of the problem and return an HTTP 403 Forbidden
• If the above is successful, then do something with that object that's action-specific (ie: render it in a view).

These steps are so standardized that I want to have reusable code to implement the behavior.

My current plan of attack was to have a helper method to do something like this:

public static ActionResult HandleMyObject(this Controller controller, 
    Func<MyObject,ActionResult> onSuccess) {
  var myObject = MyObject.LoadFrom(controller.RouteData).
  if ( myObject == null ) return NotFound(controller);
  if ( myObject.IsNotAllowed(controller.User)) return NotAllowed(controller);
  return onSuccess(myObject);
}

# NotAllowed() is pretty much the same as this
public static NotFound(Controller controller){
    controller.HttpContext.Response.StatusCode = 404
    # NotFound.aspx is a shared view.
    ViewResult result = controller.View("NotFound");
    return result;
}

The problem here is that Controller.View() is a protected method and so is not accessible from a helper. I've looked at creating a new ViewResult instance explicitly, but there's enough properties to set that I'm wary about doing so without knowing the pitfalls first.

What's the best way to create a ViewResult from outside a particular Controller?