which layer must check if something(like account etc) exist in database

Question

I am implementing a web api and i have crated three layers,data access layer,business layer and presentation layer.

In data access layer I have a method which create a user.I use a transaction which contain and a method searchByUsername which check first in the database if a username exists .If not exist then i create the user.

public bool CreateUser(CreateUserRequest request)
{
    //START TRANSACTION....
    if(searchByUsername(username))
      {
          throw new Exception("Not valid username")
      }
      else
      {
          var res =db.Execute(....);
      }

}

This concept is good practice tο use transaction in data layer? I thought that I must use transaction because if my API has many requests maybe another user create account with the same username before the inserting of another user .

Answer 1

I would argue that in this particular case, it should be neither. If you require that users have unique usernames, then that is the concern of the database. Any decent database should allow uniqueness constraints, and applying them properly means you will have no issues with race conditions.

Answer 2

In my opinion, it is the Data Access Layer which is responsible for checking and returning the result to the upper business logic layer. One might argue that not allowing duplicate user is a business decision and should be checked in business layer. But the point is,

There is a difference between detection responsibilities and decision responsibilities.

Detection can happen in lower layers but decision should be taken by the business logic layers. That means lower layer must propagate the results to upper layer by return result or exceptions. Pseudo example code can be,

Class DaoLayer {
    public bool CreateUser(CreateUserRequest request) {
        //START TRANSACTION....
        if(searchByUsername(username)) {
            throw new Exception("Not valid username")
        }else{
            var res = db.Execute(....);
        }
    }
}

Class LogicLayer {
    public bool CreateUser(Request request) {
        try{
            // some logics
            DaoLayer.CreateUser(request)
        }catch(e){
            if (e == DUP_USER)
                // take business decision
            // if necessary thow e to upper layer
            // other logics
        }
    }
}

Answer 3

If I understand your problem correctly, you have an end point for creating transactions. To create a transaction, you (obviously) need to have a valid user. This is where my first questions arise:

• What kind of transaction are we talking about?
• Can you only create transactions for your own user (and if so, do you need to be signed in)?

If you actually do need to be signed in (and can only do transactions on your own behalf), then the API shouldn't even let you access the end point (401 unauthorized), if you are not signed in. And the user for which the transaction is created, should not be parsed to the API end point as a parameter, but rather be based on the sign in.

If my understanding is not correct, please let me know and I will try to update my answer.