I am working on handling authorization for an application. I need some way for a command handler to ask the Authorization bounded context "Is this user allowed to perform this action?".
User account creation, deletions, locks, etc. as well as permission and roll management will generate the appropriate events.
The best option I can think of at the moment is to have a service class that exposes a
CanUserExecuteCommand(Guid userId, Command command) method that command handlers can call as needed. This service would listen for account/permission events and any other relevant domain events to track which user can do what.
To me, this looks like a query (no side effects, event stream projections), however, deciding what a user can or can't do sounds like business logic to me.
Is it appropriate to have this kind of logic on the query side? And where should this service live, along side the domain model, or in the read side? Is there a better way to design something like this?