Sample .NET C# MVC project using Entity Framework with Database First, Multi-Tie architeture and Role-based security?

Question

Is there a 'official' or 'better' way to implement a .Net C# MVC project using Entity Framework with Database First, Multi-Tie architetire and Role-Based security?

I did some MVC projects using Entity Framework with Database First. Because the projects are relative simple, so whenever need to query, I create the entity in the controller, do the LINQ query directly. Now, if I want to implement multi-tie architeture, does that mean I need to refactor all these, and seperate all query codes into a service layer? even for a very simple query?

As for Role-Based security, oftern time, the UI are different based on the Role. For example, for admin, all buttons should show up. but for regular user, maybe we only want to show 1 button. In this case, I usually use razor syntax in view and check role again in controller. Is this the correct way?

I'm wondering whether there are some sample projects for how to in these cases. I could not find them after some search.

Thanks

Answer 1

This sounds like a lot of unrelated questions.

• Yes, for any complex solution you really need to move all of your database logic outside of the Controller layer.
• There are tons of ways to structure your application and different design philosophies. You can look at this answer for some ideas, but in the real world picking the right architecture is a difficult problem with no one-size-fits-all solution. You have to consider functional and non-functional requirements, maintainability/extensibility needs, end user/consumer capabilities and expectations, even the personalities of users. It's impossible to build a good example you can just copy and apply everywhere.
• If you're using role-based security, checking in the view is OK. It's a UI problem to decide whether to show that button or not, so ultimately you're going to end up with an if statement in your Razor view. Different people may argue over whether you should check the roles directly there or store something on the model to determine what should or shouldn't display, but ultimately it comes out to nearly the same thing.