Securing web application on the data access level

Question

Hello!

Please consider the following setup:

1. Multi-tenant webapp.
2. Tenants create company accounts and company accounts have user accounts under them.
3. Users have roles, there's a special role "Owner" (the user who created the company account).

I'd like to have users to edit other user accounts (some admin tasks), but two conditions must be met:

1. Noone may edit owner's data (except for owner, when he's editing his own profile, and own profile editing is the same user editing).
2. Users may access user data and edit users only within their company account.

The app uses MVC architecture. Currently I check for those two conditions in the web layer and it works for me, but I have some concerns. If I go with some sort of API or some other type of data consumer, I may "forget" to re-inforce these conditions. Also, there will be other objects in the app with similar functionality requirements and which will have similar restrictions on them, so it's better for me to come up with some sort of pattern which will enforce my restrictions on data access level.

Could anyone recommend some approach worth looking into?

Thanks!

Answer 1

I beleive aspects or interceptors should be able to help you. If you work with objects you should be able to intercept requests containing your business data and check wether your user is allowed to work on it. The interceptor could then stop or proceed the execution.