Let’s say we have a REST interface of the Account resource
Admin/Account/Get
[Authorize(Admin)]
public ActionResult Get(id)
{
if(id > 0)
return _userService.Get(id);
else
return _userService.GetAll();
}
public ActionResult Post(account)
{
return _userService.Save(account);
}
This Rest interface was created first for the use of the Admin of the server. So at first is only a private api. What is better? To create a different interface for the same resource but for the public api (different consumer) like the following:
Account/Get
[Authorize]
public ActionResult Get()
{
return _userService.Get(user.Id);
}
Or to create the same interface for the same Resource like this
Account/Get
[Authorize(Admin, Users)]
public ActionResult Get(id)
{
if(admin){
if(id > 0)
return _userService.Get(id);
else
return _userService.GetAll();
} else {
return _userService.Get(user.Id);
}
}
public ActionResult Post(account)
{
if(admin)
return _userService.Save(account);
return null;
}
It is better to have the same interface for the same resource regardless the consumer. Or is better to have a different rest API if the consumer has different privileges? Why?