I have a web application that has Users that belong to Companies. A User can only belong to 1 Company at a time and they can manage their own company information. I'm using java spring and I'm following Hexagonal Architecture.
So, I came up to the conclusion that i should check if the User really belongs to the Company at the start of almost every Use case in order to continue with the transaction, because if the User does not belong to the Company -> the transaction must stop. A user can only manage and access information of his own corporation, if the application detects that someone is trying to manage or access something from another company it should throw an unauthorized error (something like "This user is unauthorized to manage information from this company").
In order to do that, I use a path variable to know from which company the user is making the call. I pass this path variable to all the use cases so i can verify if the User really belongs to the Company.
First question: Do i have to check this from the backend? and... Do i have to check this in the use cases?
Second question: If so, how am i suposed to deal with repeated code in multiple use cases? Should i create a function called checkUserCenterAuthorization(username, centername) that does the same in every Use case?
This method [checkUserCenterAuthorization(username, centername)] would actually retrieve the User from database (userDAO.getUserFromUseranem(username)) and check if the attribute Centername of the user is equal to the Centername from the REST call.
Is there anyhting that i'm missing here?