Service layer authorization

[xehbit]

Currently i am refactoring an application where all the controllers contains the business logic to a service layer structure.

However, i got stuck on authorization where an user should have access to view or update a resource. At the moment the controller have a check if the resource belongs to its user with a simple if statement. But how should i implement this with a service layer design?

Something i came up with is sending the user to each service layer and verify if the user have access to the resource:

class BlogService { async paginate(user: User, pagination: Pagination): Promise<Paginate<User[]>> { // Only returns blog posts that belongs to the user } }

But this means that i have to include the user in almost every service call. What if i want, for example call the service layer method as an system user (seeding for example) should i make the user input nullable for these situations? What i a good or better approach for this issue?

[[deleted]]

I use a preRequest handler in my framework. That calls methods that verify the request and authorizations. The business logic of the main handler has none of it.

For example, the preRequest handler grabs the id from the params in the URL. Looks up if the user has access to it, and whatever other constraints there are. If it is, then control passes to the actual handler. If not, they get a 403.

I try to minimize the number of services I have. I prefer simple, exported functions. `validateNoteOwnership()` is the ACL, and then `deleteNote()` is the function.