suppose you develop a simple mall: a store has a shopkeeper, several clerks, and several goods. The rule is:
shopkeepers can add / change / delete shop assistants and goods
shop assistants can add / change / delete goods
if you now write the interface update_product (id) to change an item, according to the above rule, you must check the following items: whether the item identified by
id exists? There is no Times fault, or go on.
find the store to which the item belongs, and the foreign key constraint ensures that the store must exist;
check whether the currently logged-in user is the owner or clerk of the store, and if so, perform the action, otherwise report an error.
question 1: are all these check codes, which need to read the database, written in this interface?
question 2: is it easier to use RBAC than to write check code directly?
Thank you!