I am developing an application using Angular and REST API and I'm facing a problem concerning user access right.
The application runs this way:
- A user signup
- The same user creates his organization
- He invites people to join the organization
- Every users of the organization are able to manage many different things, like tasks, agenda, etc...
This flow can appear many, many, many times.
Concerning the global rights, I m mean there, the fact that a user of an organization A cant access the task of an organization B etc...
Does it exist a pattern to avoid me, in each of my API methods, to check the organization ID, meaning that sometime, I have to work through multiple other objects and tables or collections, implying many databases requests (and more with reflexive classes)?
Concerning the roles, should I test the role each time a user sends a request (meaning, that I have to request the role table and check if he can access this API endpoint)? Or does it exist another pattern there too?