9

I have a Windows authenticated MVC application with a repository layer. All interaction by the controller with the database is done through the repository. Each controller has a reference to the repository:

public class PostController : Controller
{
    private Repository db = new Repository();

    [HttpPost]
    public ActionResult DeletePost(int id)
    {
        // Authorize that the user is allowed to delete this post...

        db.DeletePost(id);
    }
}

My question is whether there is a good way to move my authorization logic into the repository layer. I'd like the Repository.DeletePost() function to refuse to delete posts that were not created by the authenticated user. The problem is that my repository does not know who the authenticated user is. The controller knows (via Controller.User).

Passing the Controller.User into the Repository constructor doesn't work, because the Controller.User is apparently not defined at the time when the constructor is called.

How can I inform the Repository of who the authenticated user is? Would it be best to just construct the Repository within each action? Or is it a bad idea to handle it in the repository layer?

3 Answers 3

5

Or is it a bad idea to handle it in the repository layer?

I think the Controller is a better place for your authorization. Let the repository be a gateway to the data and the controller be a gatekeeper to your application. I'd expect to see authorization/authentication logic as early in the life-cycle as possible.

3
  • 1
    I can appreciate that... I'm going to see how it feels putting my authorization logic in the repository. If it ends up feeling dirty, then I will probably come back to your suggestion.
    – Eric
    Feb 15, 2013 at 19:59
  • I have a system with WebInterface & WebService, of course i need two authentication logics, but I dont want to duplicate the authorization code... how do you solve this?
    – Tomer W
    May 3, 2014 at 7:50
  • 1
    If you don't authorize at both levels, then how else can you control access? You probably want to authenticate at the UI layer and verify authentication at the service layer. Then, authorize at the UI and service layer.
    – Big Daddy
    May 5, 2014 at 11:57
1

Just do something like:

db.DeletePostForUser(id, User.Identity.UserId);

Then in your repository:

public void DeletePostForUser(int id, int userId)
{
    var post = context.Posts.SingleOrDefault(m => m.PostId == id && m.User.UserId == userId)
    if (post != null)
    {
        context.Posts.Remove(post);
        context.SaveChanges();
    }
}
3
  • Good suggestion... I ended up going with something else, because there may be many times in my repository when I want to know who the User is, and I'd like to avoid adding it to so many signatures.
    – Eric
    Feb 15, 2013 at 20:02
  • Basically, @uriDium is right, repositorys are for just getting and setting. They are not there to protect from which user is doing it. That is the job of the domain. What about when you suddenly need to make some changes in the database by an administrator? Who accesses it doesn't matter, if you want to restrict access then you restrict access on a lower level in the controllers. Then the service layer (which might be in the controller) would do the work of validating if they user can make these changes (even if it involves calling the database for some odd reason)
    – Worthy7
    Aug 24, 2016 at 9:21
  • Depends on what you're doing. Using a by-the-book repo with Entity Framework, is pointless. Entity Framework, or any other ORM for that matter, is you DAL layer. However, I personally use a wrapper class around my ORM where I would do stuff like this, but that's part of the business layer, at that point. Sep 1, 2016 at 16:49
1

Good suggestions from both @BigDaddy and @ChrisPratt.

I ended up solving this by creating a base controller, similar to this answer. My base controller class looks like:

public class BaseController : Controller
{
    private ILog _log;
    private Repository _db;

    protected Repository Db
    {
        get
        {
            return _db ?? (_db = new Repository(User));
        }
    }

    protected ILog Log
    {
        get
        {
            return _log ?? (_log = LogManager.GetLogger(this.GetType()));
        }
    }
}

All of my controllers inherit from this class, and have built-in access to a lazy-loaded Repository that has a reference to the currently authenticated user.

1
  • This is what im actually doing, but i feel it doesn't have enough "decoupling" as now our repository is tied to our User, which could be some kind of Admin who wouldn't be able to do anything unless you had accounted for it at every step
    – Worthy7
    Aug 24, 2016 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.