I'm asking this question for a colleague since he doesn't have enough reputation to post images in a question
During our normal development we found a deficit in our REST Api.
We display entities in our UI like this. Whereby the buttons at the top are so called actions.
In the Image you can see buttons which act as actions and a Kendo Grid/Table component. The Entry ReportExecutionJob is selected in the table and now the actions can either be used on that selection or not.
In depth details
An action itself is generic. It doesn't know a lot of stuff or metadata and more over just performs a task on any given object. For example you can add an action called delete and it will try to delete whatever entity you gave to it.
We have a user permission system and an seperated general permission system which will tell which actions are allowed on a given entity.
Example:
There can be an permission that you can perform the delete action on entity X but on the same instance the user might not have the permission to invoke the action at all.
Problem
When for example the ReportExecutionJob is selected we perform a check in the FrontEnd if the action (Pause for example) is generally allowed for the selected Entity. Afterwards the Backend holds the business logic to check if the user has the permission to invoke that action on the selected entry.
Resulting in two places handling one topic/problem.
Questions
There are some questions on how to do this the most efficient and safest way.
Would you suggest to get the informations (allowed on entity, allowed by user) as part of the entity in the response?
Should it be loaded from the Action itself ( so when something is selected, a request in the background is done which gets a result if the action is enabled or disabled on the entity and if the user is allowed)
Is there a best practice method or recommendation?
And also my colleague has the question when all this should be done. Wether on loading the page, when selecting the entry in the table or when trying to perform the action?
Best Answer
There are a few ways to handle this, but generally you will ideally have the information on the client before the new drop down item is selected, for user experience reasons.
From there, it’s really up to you how you tell the front end what actions a given item is allowed, but one method I’ve seen that is pretty clean is by using HATEOAS (Hypertext As the Engine Of Application State).
In that case, each time you fetch a resource from the server, it’d include all the data, but then also include metadata in the form of links to the other supported actions. That would be an easy way to tell the client what other actions are supported for the current user, and the client could figure out what buttons to display or enable.