Let's say that we have some sort of "schema" for a rest resource, something like (pseudocode):
ExampleResource: field1 = field(validate=is_string()) field2 = field(validate=is_int()) field3 = field(validate=is_string(max_length(200)) creator_id = field(validate=is_int())
Depending on the permissions the user has, his access should be limited. For example, we might have a user that can POST new resources, but can only PATCH the resources he has created (creator_id is equal to his unique id), we might have another user that can GET all resources, but only has permissions to view field1 and field2 on the resources, we might have a user who only has permissions to PATCH field2 on all resource, etc.
So my question is - would checking the users permissions be part of validating? Something like this:
ExampleResource2: field = field(validate=[is_string(), check_permission(create=permission1, edit=permission2, view=permission3)])
I am currently working on a project where permission checks are implemented this way, and I am looking for some input on this - is this good practice? Does it make sense? How else would you implement this?
My own thoughts: On the one hand, since each field is checked for validity anyway, it kind of feels efficient to also check for permissions at the same time - otherwise, you would first have to go through all the fields and check all the permissions, and then go through all the fields again to validate them. On the other hand, this kind of design doesn't feel very SOLID to me.