We have a managers api (/api/managers/-/staff), which will get a list of staff that the currently logged in manager has been granted access to. It is the Managers service.

We also have a staff api (api/staff/[StaffGUID]/obs/sessions) that will get staff data. You have to be an authenticated manager to make a call to the staff api.

I want to make sure that Manager B could not call the staff api with a StaffGuid that they do not have access to.

My current thinking is that I want to call the Managers api from within the staff/[StaffGUID]/obs/sessions endpoint to answer the question, "Does the currently authenticated manager have access to this patient?".

I would GET https://ourapi.com/api/v1/managers/-/staff/StaffGuid and then listen for a 403 or a 204. No content needed just a Status.

Make sense?



If you have a database of staff you would assume that the relation ship of who managed who is in that database. It would be one repository, one Domain Aggregate, one responsibility, whatever you want to call it.

I would expect anything that has access to a Staff object to also have access to the managerial relationships and hence be able to check that the calling staff member was a manager of the staff they were trying to check on without going out to a separate API

| improve this answer | |
  • The managers are told to manage stores. That relationship is a role that is managed within the manager service. Staff data belongs to the member of staff but because they do work that could be related to one or more branches. There is a relationship between the staff members and one or more stores. So the connection between manager and staff data is via the store and there could be multiple managers looking after a store – Pat Long - Munkii Yebee Nov 4 at 0:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.