design patterns - Where to apply domain level permissioning -

permissioning/authorization (not authentication) cross-cutting concern, think.

in onion architecture or hexagonal architecture, should permissioning performed? examples of permissioning required be:

• filtering data returned front end (ui, api, or otherwise)
• validating business operation can performed @ all

ideally, via single responsibility principle, code performs business operations , returns data shouldn't need aware of user's permissions @ all. implementations of functionality should know how perform business operations or query repository or domain service - that's it.

would wrapper/facade implementing same interface class performing business operation or returning data place put permissioning? or there better way?

also, if best practice permission activity, not role, still valid permissioning should performed service purpose return data?

one argue access checking should close code performs operation possible reduce chance can find side-channel bypasses access checking. said, if can use wrapper class such guarantee in production system access checking in place, think fine.

validating business operation can performed @ all

i find natural put access checks determine if operation can performed or not in wrapper. wrapper code typically simple glue understands arguments being passed protected function , converts form appropriate making authorization decisions.

filtering data returned front end (ui, api, or otherwise)

by assuming mean filtering rows out of query's response based on permissions of caller. example, if department manager makes query everyone's salary, manager returned salaries of people report him/her don't have permission access other people's salaries.

for type of filtering have never found way of implementing crosscutting concern. have either baked filtering business logic or fallen on model refuses allow query execute due lack of permission.

the problem i've faced that, enable filtering, security code must @ data returned , able associate permissions it. seems fair amount of work in simple case , downright hairy in complex case (imagine data set being returned join of several database operations).

that said, i'm not against content filtering. haven't seen solution it.