I'm creating a 3-tier Web API application based on the Azure guide here. This has a middle tier and a data tier both in Web API.
So far my application is pretty simple, the middle tier receives a request, translates it to the domain model, passes it to the data tier which performs a CRUD operation which is then passed back and mapped back to a DTO for the client.
Now I'm starting to look at request verification. When a CREATE request comes in to the middle tier it may link to existing entities and so require the following checks:
- I need to verify that the linked entities belong to the current user
- Check to see if the user already has an 'Active' entity of the same type requested.
- Check that the linked entities support the requested entity
To me, calling the data tier for each of these (and there could be multiple in each request) is adding a bit of overhead as I'm going to have to do an additional service call for each one which could add to the request time.
Should data retrieval sit solely in the data tier (I know that sounds obvious...) or can some go in the middle tier? The middle tier will only do retrieval, no manipulation.