vendredi 10 mai 2019

API role based permission design issue

I have written an api using ask.net core 3.0 web api. It uses filters that require users to have certain user roles for different functions.

While this design works for simple functions, I have an issue when trying to test in a formulaic way when there is more context needed than just user role.

Working example: CustomerController Function Create - require user role a,b,c

Failing example AssignmentController Funtion Create - depends on values within the “Assignment”

I could solve this by explicitly naming my api functions:

CreateAssignmentTechnician CreateAssignmentEngineer

But that seems very wrong.

Any suggestions?

Aucun commentaire:

Enregistrer un commentaire