I work on an application that services a large hospital. The application allows users to create/edit/delete a series of data points that all relate to a specific drug being researched. Once the data is entered and considered complete, a higher level parent table in the database is tagged with a "Production" status. We can go back to this table to determine what the status of the data is.

What we would like to do now is disable the ability for users to modify the data. The rule for allowing / disallowing data entry is of course based on the status - if "Production" then we want to disable, otherwise it can be editable.

A few notes:

  • The application itself is fairly JavaScript heavy, and uses Backbone.js to GET/POST data via AJAX in many places.
  • The back end is written in C# and utilizes both Web Api 2 as well as standard MVC 5 controllers.
  • By disable, we want to hide any Create/Update buttons & disable form inputs on the front end, and restrict access to certain controller methods that are responsible for creating/updating data in the database.

In what areas of the application would the code to restrict the ability to modify data be written?

  • 2
    Keep your business logic out of your database. If you want to disable editing when your record is in a certain state, then enforce that in the application layers. Make your Server and Client deny those operations. If your Server is the only way to access your database (and it usually should be) then the problem is solved. – MetaFight Aug 15 '15 at 11:24
  • 1
    If you're familiar with the application, you're probably better placed to answer the question than we are. – Jules Aug 15 '15 at 11:25
  • 1
    "In what areas of the application would the code to restrict the ability to modify data be written?" - In the areas which deal with the modification of the data, where else? – Doc Brown Aug 15 '15 at 14:42

In the business layer you simply don't honor any update even if it does come from the UI. I guess you could also do this in the data layer but that does not mean skip it in the business layer. For that matter you could also enforce it a the database with for example triggers.

In the business layer you expose a flag / property of IsEditable (or some other name).

In the UI layer react to IsEditable properly. Disable edit if IsEditable = false.

Not the answer you're looking for? Browse other questions tagged or ask your own question.