I work on an application that services a large hospital. The application allows users to create/edit/delete a series of data points that all relate to a specific drug being researched. Once the data is entered and considered complete, a higher level parent table in the database is tagged with a "Production" status. We can go back to this table to determine what the status of the data is.
What we would like to do now is disable the ability for users to modify the data. The rule for allowing / disallowing data entry is of course based on the status - if "Production" then we want to disable, otherwise it can be editable.
A few notes:
- The back end is written in C# and utilizes both Web Api 2 as well as standard MVC 5 controllers.
- By disable, we want to hide any Create/Update buttons & disable form inputs on the front end, and restrict access to certain controller methods that are responsible for creating/updating data in the database.
In what areas of the application would the code to restrict the ability to modify data be written?