title: Should an object test if a user can edit it, or should a controller do a lookup? MVC4
body: <p>My database looks like this:</p>
  
  <p><strong>[Table] UserProfile</strong></p>
  
  <ul>
  <li>UserName</li>
  </ul>
  
  <p><strong>[Table] Category</strong></p>
  
  <ul>
  <li>CategoryId (PK)</li>
  <li>UserName (link to UserProfile - this is the record owner)</li>
  <li>ProductID (FK to Product Table related records)</li>
  </ul>
  
  <p><strong>[Table]Products</strong></p>
  
  <ul>
  <li>ProductId (PK)</li>
  <li>CategoryId (Navigation Property)</li>
  </ul>
  
  <p>A logged on user can only edit Categories and Products that they own. I'm happy enough doing a lookup on Category based on the User.Identity.Name and CategoryID received by the Controller from the view, if I don't get a record back then it doesn't exist or the user doesn't own it. I've started to think this isn't the best way to do it, but it works...</p>
  
  <p>My question relates to the best way to handle this type of check on Products?</p>
  
  <ol>
  <li>Should I have a query that uses the navigation property to ProductId to then get the <code>UserName</code> value? </li>
  <li>Should this be done by a linq query in the controller or a method on the Products class? i.e <code>prod.ConfirmOwnerIs(User.Identity.Name)</code> </li>
  <li>Should this be an external helper method like <code>Helpers.ConfirmUserCanEditObject(prod, User.Identity.Name)</code>?</li>
  </ol>
  
  <p>This example is slightly simplified, my real data model is several layers deep. This is a learning project for me so I'm trying avoid doing something that will hit the DB unnecessarily or in an inefficient way, or become a beast to maintain and test. I'm hoping for some guidance and wisdom here. Thanks.</p>