Where does apply authorization rules for my layered application?

Question

This question is about applying rules of my application that confuse me.

My controller is using service and the service is using repository.

public class CommentController: ApiController{

    [HttpPost]
    public bool EditComment(Comment comment){
        commentService.Update(comment);
    }
}

public class CommentService{
    ICommentRepository repository;
    ....
    ....
    public void Update(Comment comment){
        repository.Update(comment);
    }
}

If the user is authenticated, he can update a comment.

• But a user should edit own comments.

• But an admin can edit all comments.

• But comment can not edit after a specified date.

• Edit by a department

And I have something like these rules.

If I apply "user editing own comment" rule in service layer, I will change Update methot and pass parameter of controller User.Identity.Name,

public class CommentService{
    ICommentRepository repository;
    ....
    ....
    public void Update(string updatedByThisUser, Comment comment){
        // if updatedByThisUser is owner of comment
        repository.Update(comment);
    }
}

But, is true changing service operations by rule?

I am confused a bit about where can I apply the rules. In controller or in service or in repository.

Is there any standart way to do this like design patterns.

Answer 1

I would

• create a seperate PermissionService that implements methods like isUserAllowedTo(user, PermissionService.Permissiontype.Update, PermissionService.Topic.COMMENT, additionalContextRelevantParameters)
• and call the PermissionService methods in the controller, where neccessary context info (i.e. from session) is available.

You can design your architecture to call the permission service in the CommentService. But i would not recommend this because this would add additional dependencies into the service (i.e. session) that makes unit-testing the service much more difficuilt

Answer 2

First, take some time to consider what the comment service is actually responsible for. This will depend on your specific requirements, and possibly even your own best judgment.

If the comment service's responsibility is limited to updating any given comment, then what you have written is well. In this case, you will need to consider some other conditional logic for checking whether any given comment can be updated. You will probably do this in the controller, or you may create a separate sub system for checking if a User can post a comment. You could re-use this just like you plan on re-using the comment service.

If the comment service is responsible for updating a user's comments, then your service becomes Update(User user, Comment comment) and you have flexibility to check business rules within the service itself.

Now that you are clear on what your design intentions are, you will have clarity on how to implement your solution.