Question

A n-tier layer project.

In businesslayer, there is a inherited Class Called BaseEdit which contains contractor and base properties.

There are about 30 CustomEdit (inheriting classes), all of them has methods “Load“,”Save” and “Delete“.

The require for this existing system is to add a readonly user.

Possible solutions considering the cost of works:

1) Modify the BaseEdit so all CustomEdit can stay the same.
The system will check ‘user role’ in session by using httpcontext then to accept or reject the user’s action.

So Question1: Can vb.net achieve this?

‘BaseEdit

Public Function Save() Boolean
 'check session in BusinessLayer, if it is ready only user
 'then Validation is false
End Function

‘CustomEdit

Public Function Save() Boolean
 'Proceed the save
End Function

But when I invoke CustomEdit.Save(), the BaseEdit.Save() will not be invoked.
Seems vb.net doesn’t support this kind of partial methods.
Is there a way to achieve this without changing CustomEdit?

2) In SQL Server, Check Session States and restrict user access to Insert or Update StoredProc.
Question 2: Should it be taken place in SQL Server? Anyone has experiences about this? Any comments for advantage/disadvantage?

Question 3:In my opinion, the user restriction should be achieve in web layer or the Business layer by authentic controls.
Someone told me the security access stuff should be as close as to the database, is it right?

Answer 1

This question seems very similar to this, and I believe the answer would be valid for you too. Modify BaseEdit to be the only class with Save(), in which you call the abstract “ProtectedSave()”, which all base classes must implement. That way you control what and which methods are executed in the Save() function.