4

Is there a 'official' or 'better' way to implement a .Net C# MVC project using Entity Framework with Database First, Multi-Tie architetire and Role-Based security?

I did some MVC projects using Entity Framework with Database First. Because the projects are relative simple, so whenever need to query, I create the entity in the controller, do the LINQ query directly. Now, if I want to implement multi-tie architeture, does that mean I need to refactor all these, and seperate all query codes into a service layer? even for a very simple query?

As for Role-Based security, oftern time, the UI are different based on the Role. For example, for admin, all buttons should show up. but for regular user, maybe we only want to show 1 button. In this case, I usually use razor syntax in view and check role again in controller. Is this the correct way?

I'm wondering whether there are some sample projects for how to in these cases. I could not find them after some search.

Thanks

urlreader
  • 6,319
  • 7
  • 57
  • 91
  • It sounds like you may be looking for a [repository pattern](http://www.codecompiled.com/repository-pattern-in-c/). – Chaim Eliyah Jun 14 '16 at 20:48
  • IMHO, you should abandon Role based security......and go to "Claims". There is a special type of Claim for roles...at the very least, implement that. See https://msdn.microsoft.com/en-us/library/system.security.claims.claimsidentity.roleclaimtype(v=vs.110).aspx – granadaCoder Jun 14 '16 at 20:53
  • See https://msdn.microsoft.com/en-us/library/hh291061(v=vs.110).aspx and https://visualstudiomagazine.com/articles/2013/08/01/leveraging-claims-based-security-in-aspnet-45.aspx for some "basics". – granadaCoder Jun 14 '16 at 20:54
  • You may also be able to use an attribute filter for the roles. It's very quick to set up. – Drew Kennedy Jun 14 '16 at 21:00

1 Answers1

2

This sounds like a lot of unrelated questions.

  • Yes, for any complex solution you really need to move all of your database logic outside of the Controller layer.
  • There are tons of ways to structure your application and different design philosophies. You can look at this answer for some ideas, but in the real world picking the right architecture is a difficult problem with no one-size-fits-all solution. You have to consider functional and non-functional requirements, maintainability/extensibility needs, end user/consumer capabilities and expectations, even the personalities of users. It's impossible to build a good example you can just copy and apply everywhere.
  • If you're using role-based security, checking in the view is OK. It's a UI problem to decide whether to show that button or not, so ultimately you're going to end up with an if statement in your Razor view. Different people may argue over whether you should check the roles directly there or store something on the model to determine what should or shouldn't display, but ultimately it comes out to nearly the same thing.
Community
  • 1
  • 1
Tim Copenhaver
  • 3,282
  • 13
  • 18