I'm asking this question for a colleague since he doesn't have enough reputation to post images in a question
During our normal development we found a deficit in our REST Api. We display entities in our UI like this. Whereby the buttons at the top are so called actions.
In the Image you can see buttons which act as actions and a Kendo Grid/Table component. The Entry ReportExecutionJob is selected in the table and now the actions can either be used on that selection or not.
In depth details
An action itself is generic. It doesn't know a lot of stuff or metadata and more over just performs a task on any given object. For example you can add an action called delete and it will try to delete whatever entity you gave to it.
We have a user permission system and an seperated general permission system which will tell which actions are allowed on a given entity.
Example: There can be an permission that you can perform the delete action on entity X but on the same instance the user might not have the permission to invoke the action at all.
When for example the ReportExecutionJob is selected we perform a check in the FrontEnd if the action (Pause for example) is generally allowed for the selected Entity. Afterwards the Backend holds the business logic to check if the user has the permission to invoke that action on the selected entry.
Resulting in two places handling one topic/problem.
There are some questions on how to do this the most efficient and safest way.
Would you suggest to get the informations (allowed on entity, allowed by user) as part of the entity in the response?
Should it be loaded from the Action itself ( so when something is selected, a request in the background is done which gets a result if the action is enabled or disabled on the entity and if the user is allowed)
Is there a best practice method or recommendation?
And also my colleague has the question when all this should be done. Wether on loading the page, when selecting the entry in the table or when trying to perform the action?