I understand Web API. I understand websites, how they call a web API and all the good stuff. My question is, how do you control the user view in the website consuming the API, based on the API permissions. The goal would be to not have the view in the website if the user is not authorized to preform such action. Not just do a trick and hide it the HTML (Tech-savey user can see html code for actions/data forms they shouldn't).
Simplified Scenario: User has access to API to create other users, but not delete. They can technically send the delete verb to the URI, but they would get access denied. The goal would be for the HTML website to not show the delete option in the first place, as they cannot preform the action anyway. As well as no way of knowing via the website HTML/JS to see where the delte option is/how it works (Of course the delete view shows to users with that permission set)
Idea's: Have API support sending the HTML code for views on the site based off permissions. -Not a big fan of this as I feel it sorta breaks the idea of the API. What if I need to do something similar on a mobile app?
Use server side code as intermediary to call the API and build the view. -Im not sure about this because I feel it will require a redundant amount of work, but may be the best option.
I am using c# .net for this, if that matters. Preferably strictly HTML JS for the website, but don't believe thats possible unless sending HTML from the API.