数据访问库:如果不允许访问或未找到数据,则返回什么?
我正在为基于小部件的报告应用程序构建 DAL,其设计方式是让用户选择、配置报告“小部件”并将其部署到其主屏幕。小部件可以报告各种类型的公司数据 - 站点、品牌、员工等。
虽然所有用户都可以访问所有小部件/报告,但并非所有用户都被授权访问所有数据。如果我在 A 公司工作,我无法查看 B 公司的销售报告或 C 公司销售人员的员工出勤数据,但是我可以配置此类报告并将其添加到我的“仪表板'。
在运行时,中间“DataService”类的任务是检查用户的凭据,如果允许访问,则将适当的对象集合返回给客户端。
在初始构建中,如果不允许访问数据,我只是返回一个空列表,但如果报告没有返回数据(可能会发生),这也是我所做的。如果用户无权查看数据,我想在前端显示“访问被拒绝”消息,但显然,如果我在任何一种情况下返回的都是空集合,则不可能知道这是否是因为权利不足或没有数据。
如果您能建议一种围绕此进行编码的方法,我将不胜感激,我的第一个想法是将凭证检查移至另一个对象中,该对象又调用数据访问类,但时间限制意味着这不是一个选择。
我唯一能想到的,与我所学的一切相悖的是,如果未授予访问权限,则抛出自定义异常,例如 InsufficientApplicationPrivilegeException,但这闻起来很糟糕。
感谢您的阅读。
I'm building a DAL for a widget-based reporting application, its been designed in such a way that users pick, configure and deploy reporting 'widgets' to their home screens. Widgets can report across various kinds of company data - sites, brands, employees and so on.
Whilst all users can access all the widgets/reports, all users are not authorised to access all data. If I work for Company-A I can't view sales reports for Company-B or staff attendance data for a salesman at Company-C, however I can configure such a report and add it to my 'dashboard'.
At runtime, an intermediate 'DataService' class has the job of checking the user's credentials and, if access is permitted, returning the appropriate object collection to the client.
On the initial build I just returned an empty List if access to the data was not allowed, but this is also what I do if no data is returned by the report (which can happen). I'd like to show an 'Access Denied' message on the front end if the user isn't authorised to view the data but obviously if all I get back in either eventuality is an empty collection its impossible to know if this was because of insufficients rights or just no data.
I'd be grateful if you could suggest a way of coding around this, my first thought was to move the credential-checking into another object which in turn calls the data access class but time constraints mean this isn't an option.
The only thing I can think of, which goes against everything I've ever learnt, is to throw a custom exception e.g. InsufficientApplicationPrivilegeException if access isn't granted, but this smells bad.
Thanks for reading.
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(1)
我认为你有几个选择。一种是创建数据服务类返回的复合对象。复合对象看起来像这样: -
ServiceResult 包含有关服务调用结果的元数据 - 它可以是一个枚举,其中包含例如 Success、AuthenticationFailure 等。然后,您可以打开它以执行不同的行为。
另一种选择可能是使用 NullObject 模式,该模式在视图中显示单个数据项,而不是实际数据,只是显示对象的显示属性的“访问被拒绝”。这种方法的优点是你的前端不需要任何条件逻辑等;但是,如果您想显示特定的消息框或类似的内容,而不仅仅是在小部件中显示虚拟数据行,那么这可能不合适。
I think you have a couple of options. One is to make a composite object that your data service class returns. The composite object looks something like this: -
ServiceResult contains metadata about the outcome of your service call - it could be an enum which contains e.g. Success, AuthenticationFailure etc. etc.. You can then switch on this in order to do different behaviour.
An alternative option might be to use the NullObject pattern that shows a single item of data in the view which instead of real data simply shows "Access Denied" for the display properties of the object. The advantage of this approach is that your front-end doesn't need to have any conditional logic etc.; however if you want to show a specific message box or similar rather than just displaying a dummy row of data in your widget, then this probably isn't appropriate.