title: MVC frameworks, API layers, and Authentication/Permissions
body: <p>I asked a <a href="https://stackoverflow.com/questions/5093813/mvc-style-application-architecture-catering-to-api">question</a> earlier, however it may have been too vague or broad to warrant an answer. I've since reconsidered my approach and my question.</p>
  
  <p>I'm working on a framework with specific application in mind, but obviously am keeping re-usability at the forefront. The key element of this framework is exposing an API layer, for JSON driven remote interaction.</p>
  
  <p>My issue in planning this out comes with <strong>authentication/permissions</strong>. <em>If I'm designing with an MVC style architecture in mind, yet want to permit usage via the API layer, where should the authentication/permissions check take place?</em></p>
  
  <p>The web access layer is essentially the same as API layer, the only difference being the output method (HTML vs. JSON), so I figured a common business logic layer for the two would make sense. Requests would be normalized to a data structure, and sent to the business logic. The business logic ultimately kicks out a result data structure (query results, failure, success, etc.) that is either fed to the Template engine, or serialized to JSON.</p>
  
  <p>It appears to me that the permissions check needs to be performed in the common business logic layer, but is there a better place to incorporate this into an MVC/API framework?</p>
  
  <p>I don't know where else to elaborate at the moment, so feel free to ask for more details and I'll provide as I come up with them.</p>