I'm developing a business web application for procurement. I use ASP.NET MVC Core 2.0, EF core 2.0, MSSQL Server. I've been searching for an answer for my question on the Internet for a couple of months but couldn't find one. Lets say i have a document and i want to control permissions for different actions on the document (read, edit, delete, edit doc number, edit different attributes of it, etc.). So i developed some IPermissionControl interface and several classes implementing this interface such as RoleBasedPermissionControl and etc. Now i have a problem. All my business logic is in .Net app, not in Db. So when user opens all permitted documents list all the documents are fetched from the db and checked for permission in the app. It makes a big performance issue, so if db has 1000000 docs, and user has permissions only for 10 of them, it is a bad idea to fetch all of them. How to solve this issue with leaving all the BL in c# app?
Thanks in advance!