you have some magic numbers there in your controller code. Why don't you swap this out in some extra class, thereby you get some interface you can mock against.
e.g.
void Main()
{
var a = new PlanAuthorizationProvider();
var result = a.IsAuthorized(true, 387484);
}
public interface IPlanAuthorizationProvider
{
bool IsAuthorized(bool isManager, int planId);
}
public class PlanAuthorizationProvider : IPlanAuthorizationProvider
{
public bool IsAuthorized (bool isManager, int planId)
{
string managerOnlyPlanIds = "387484,765675,872095,900535";
var listOfManagerOnlyPlanIds =
managerOnlyPlanIds.Split(',').Select(int.Parse).ToList();
if (listOfManagerOnlyPlanIds .Contains(planId))
{
return isManager;
}
else
{
return true;
}
}
}