0

I am implementing a web api and i have crated three layers,data access layer,business layer and presentation layer.

In data access layer I have a method which create a user.I use a transaction which contain and a method searchByUsername which check first in the database if a username exists .If not exist then i create the user.

public bool CreateUser(CreateUserRequest request)
{
    //START TRANSACTION....
    if(searchByUsername(username))
      {
          throw new Exception("Not valid username")
      }
      else
      {
          var res =db.Execute(....);
      }

}

This concept is good practice tο use transaction in data layer? I thought that I must use transaction because if my API has many requests maybe another user create account with the same username before the inserting of another user .

New contributor
dimmits is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • "I thought that I must use transaction because if my API has many requests maybe another user create account with the same username before the inserting of another user." Be careful that default transactional behaviour does not guarantee this and a different locking mechanism should be implemented. – Andy Nov 8 at 11:35
0

If I understand your problem correctly, you have an end point for creating transactions. To create a transaction, you (obviously) need to have a valid user. This is where my first questions arise:

  • What kind of transaction are we talking about?
  • Can you only create transactions for your own user (and if so, do you need to be signed in)?

If you actually do need to be signed in (and can only do transactions on your own behalf), then the API shouldn't even let you access the end point (401 unauthorized), if you are not signed in. And the user for which the transaction is created, should not be parsed to the API end point as a parameter, but rather be based on the sign in.

If my understanding is not correct, please let me know and I will try to update my answer.

  • i have an endpoint that create users.In the data access layer i have a transaction which first check if the username exist and then (if not) insert the new user in db. My question : is best practice to use transaction in dal,or in business layer check without transaction if the username exist? – dimmits Nov 8 at 11:33
  • I would argue that it all depends a lot on what type of transaction we are talking about. E.g. if it is a banking transaction then it should never be allowed to just create a new user, if one doesn't exist. It should simply fail. – Noceo Nov 8 at 11:38
  • How do you expect a user who does not exist yet (as they might still to be created in the database) to already be logged in to the system? This doesn't make sense. If the user is logged in, the entire "if user doesn't exist create the user" part of the requirement is provably moot. – Flater Nov 8 at 11:43
  • @Flater that's why I started asking about the nature of the transaction which is to be created. In a lot of cases it could pose a security concern if you were to create a user alongside a transaction, so I was trying to identify if there was more generel design issue, and then solve that first. – Noceo Nov 8 at 12:12

Your Answer

dimmits is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.