1

I am implementing a web api and i have crated three layers,data access layer,business layer and presentation layer.

In data access layer I have a method which create a user.I use a transaction which contain and a method searchByUsername which check first in the database if a username exists .If not exist then i create the user.

public bool CreateUser(CreateUserRequest request)
{
    //START TRANSACTION....
    if(searchByUsername(username))
      {
          throw new Exception("Not valid username")
      }
      else
      {
          var res =db.Execute(....);
      }

}

This concept is good practice tο use transaction in data layer? I thought that I must use transaction because if my API has many requests maybe another user create account with the same username before the inserting of another user .

  • "I thought that I must use transaction because if my API has many requests maybe another user create account with the same username before the inserting of another user." Be careful that default transactional behaviour does not guarantee this and a different locking mechanism should be implemented. – Andy Nov 8 '19 at 11:35
  • If I understand correctly... This is part of your business layer. Your data access layer only cares about fetching and saving data. – Ivan Vilanculo Dec 8 '19 at 13:50
0

If I understand your problem correctly, you have an end point for creating transactions. To create a transaction, you (obviously) need to have a valid user. This is where my first questions arise:

  • What kind of transaction are we talking about?
  • Can you only create transactions for your own user (and if so, do you need to be signed in)?

If you actually do need to be signed in (and can only do transactions on your own behalf), then the API shouldn't even let you access the end point (401 unauthorized), if you are not signed in. And the user for which the transaction is created, should not be parsed to the API end point as a parameter, but rather be based on the sign in.

If my understanding is not correct, please let me know and I will try to update my answer.

  • i have an endpoint that create users.In the data access layer i have a transaction which first check if the username exist and then (if not) insert the new user in db. My question : is best practice to use transaction in dal,or in business layer check without transaction if the username exist? – dimmits Nov 8 '19 at 11:33
  • I would argue that it all depends a lot on what type of transaction we are talking about. E.g. if it is a banking transaction then it should never be allowed to just create a new user, if one doesn't exist. It should simply fail. – Noceo Nov 8 '19 at 11:38
  • How do you expect a user who does not exist yet (as they might still to be created in the database) to already be logged in to the system? This doesn't make sense. If the user is logged in, the entire "if user doesn't exist create the user" part of the requirement is provably moot. – Flater Nov 8 '19 at 11:43
  • @Flater that's why I started asking about the nature of the transaction which is to be created. In a lot of cases it could pose a security concern if you were to create a user alongside a transaction, so I was trying to identify if there was more generel design issue, and then solve that first. – Noceo Nov 8 '19 at 12:12
  • i don't have sign in,is for academic purpose this project. but in general i would like to know what is the best practice.I should do transactions for validations i data access layer?? @Noceo For example if i would like to satisfy that i dont have duplication ,and my api has many request to handle,is a good practice to check first in data layer if exists? Beacause in business layer i cant had a transaction. Thank you very much! – dimmits Dec 9 '19 at 7:37
0

In my opinion, it is the Data Access Layer which is responsible for checking and returning the result to the upper business logic layer. One might argue that not allowing duplicate user is a business decision and should be checked in business layer. But the point is,

There is a difference between detection responsibilities and decision responsibilities.

Detection can happen in lower layers but decision should be taken by the business logic layers. That means lower layer must propagate the results to upper layer by return result or exceptions. Pseudo example code can be,

Class DaoLayer {
    public bool CreateUser(CreateUserRequest request) {
        //START TRANSACTION....
        if(searchByUsername(username)) {
            throw new Exception("Not valid username")
        }else{
            var res = db.Execute(....);
        }
    }
}

Class LogicLayer {
    public bool CreateUser(Request request) {
        try{
            // some logics
            DaoLayer.CreateUser(request)
        }catch(e){
            if (e == DUP_USER)
                // take business decision
            // if necessary thow e to upper layer
            // other logics
        }
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.