Let's say I have a company that ranks the cutest cats on the internet.
I offer a resource at
/cats/ which provides users with the latest, cutest adorable cats.
Users can either get just the top 3 cats if they haven't paid at all or registered. The top 10 cats if they paid 337 dollars and are logged in, and the top 100 cats if they paid 1337 dollars and are logged in. I have a 'user identifier' when making the request.
In short, consumers of
/cats/ get a different number of cats based on their 'user
ranking'. I do have a user identifier on the consuming end, but I have no explicit representation of the user level on the consuming end. I'd like to inform users they can upgrade their subscription when making the request. That is, I need to distinguish between 3 cats since I only offer 3 cats and 3 cats because that's what the user level allowed.
What is the best practice for distinguishing limiting the resource because the consumer does not have sufficient priviledges and limiting it because that's what the consumer has?
How does the client know if they can upgrade their ranking? That is, they only got a limited resource because they don't have permissions. What is the best practice here?
Note, this is a gross simplification of the actual case. Also, just to clarify - reading is appreciated.
Here are options we've considered:
- Storing the user permissions objects once on the client, querying for it only when account login or upgrade is performed.
nullvalues in JSON indicating it exists, but an actual nothing was transfered. So 10 cats for a user with 3 cats could be
["Garfield","Sylvester","Puss in Boots",null*7]
- Passing a resource permission pair
I'd like to do this right the first time to deliver the cutest cats in the best way possible and we'd and we'd like