I have an API design/versioning conundrum. Let's say I have an endpoint /api/customers
which GETs all customers (ignore pagination). There's a twist though: if a regular user
accesses this endpoint, they will only get the customers created by that user and no one else (I can check the access token and the sub field to determine who sent the request). Other usecase: if an admin
accesses this endpoint, they should get ALL customers, regardless of who acquired them.
Now my question is from an API design perspective: is it better to have an if/else
role check within the API controller itself to determine do I return ALL (admin) customers or specific (user) customers, OR should I differentiate between endpoints for the user and admin? I.e. admin only endpoint for all customers would be /api/admin/customers
and regular users can still access their /api/customers
?
Aucun commentaire:
Enregistrer un commentaire