When developing an ASP.NET MVC application that allows the model to be updated, you need some way to know how to take the updated view model and match it back to the model that is now updated. There seems to be a few different ways of doing this and I'm wondering if any of these are not proper MVC (much like having your controller store data that should be in the model is not proper MVC)?
All View Models have an ID: Pros
- Always ensure you can match to your model.
Cons
- You have to be real careful that none of the IDs were changed else you can have users updating rows they shouldn't have access to.
Only the bare minimum view models have an ID: Pros
- Far less checking needed to avoid users updating data they shouldn't access.
Cons
- Far more difficult to track what view models matches what model.
- You still have to check the few view models with IDs to make sure the user isn't updating data they shouldn't have access to.
No view models have ID:
Pros
- No need to check IDs for updates.
Cons
- You have to abandon statelessness.
So I have two questions.
First, is there a correct/incorrect choice? (If not, that means the choice is a matter of opinion and my second question opinion based and should be ignored.)
Second, if there is a correct/incorrect choice, which is it?
To clarify on a comment, I'm talking when you have a view model that is a mimic of your database object.
Think this:
public class InvoiceViewModel //Does not have ID, does not relate to model.
{
public CustomerViewModel CustomerVM { get; set; } //Maybe has ID? Does relate to model.
public AddressViewModel BillingAddressVM { get; set; } //Ditto
public AddressViewModel ShippingAddressVM { get; set; } //Ditto
public List<InvoiceLineItemViewModel> ItemVMs { get; set; } //Each one has an ID?
}
not this:
public class InvoiceViewModel
{
public Customer Customer { get; set; }
public Address BillingAddress { get; set; }
public Address ShippingAddress { get; set; }
public List<InvoiceLineItem> Items { get; set; }
}
You have to abandon statelessness.
- You have just made the choice to use MVC pointless.