Concern of Permission Check in DDD - domain-driven-design

Question

I have a Todo application which uses CQRS.
I want to check some permission for user who performs Create/Read/Update operations.
Given:
I have 2 group Office and Kitchen
Each Todo and User has to belong a group
Each user can perform operations according the following rules
Rules:
A user can read a Todo if it is in their group (Todo in Office & User in Office)
A user can not read a Todo if it is not in their group (Todo in Office & User in Kitchen)
A user can create a Todo in only their group (User in Office, then, Todo must be in Office)
...
Table: Groups
| GroupId | GroupName |
| 1 | Office |
| 2 | Kitchen |
Table: Todo
| TodoId | GroupId |
| 1 | 1 |
| 2 | 1 |
| 3 | 2 |
Table: User
|UserId | GroupId |
| 1 | 1 |
| 2 | 1 |
| 3 | 2 |
What I want to know:
Which layer should be responsible to check the rules above (domain, application, infrastructure)?
Where to put this control is more suitable when we think that we are using CQRS (in controller (action), in entity, in query/command handler)?
Please, let me know your ideas.
Thank you.

Answer 1

Application (aka Service), should co-ordinate the activities, and the Domain model should contain the rules.
Some of this may depend on the specifics, but you might do something like this...
// Todo Command Service
public ResponseModel CreateTodoItem(CreateTodoItemCommand command, User user) {
var userPermissionCheck = _userTodoCommandPermissions.GetPermissions(user, command.GroupId);
if (!userPermissionCheck.CanCreate) {
return ResponseModel.Failed();
}
// continue
}
I'd do something similar on the same query-side.
In-terms of CQRS, I'm not sure there is a real need to get rid of the Service layer - but perhaps your handler is designed in a way to handle this. So it sort of depends.