Stored procedure for login not working as intended - sql

Question

I have 3 tables, users, Roles, and User_Roles.
CREATE TABLE [Web].[Users]
(
[Employee_ID] [Nvarchar] (10) NOT NULL PRIMARY KEY,
[Username] [nvarchar] (25) NOT NULL,
)
GO
CREATE TABLE [Web].[Roles]
(
[Role_ID] [Int] NOT NULL IDENTITY PRIMARY KEY,
[Roles] [nvarchar] (25) NOT NULL,
)
GO
CREATE TABLE [Web].[User_Roles]
(
[Employee_ID] [Nvarchar](10) NOT NULL,
[Role_ID] [int] NOT NULL,
CONSTRAINT FK_Employee_ID
FOREIGN KEY (Employee_ID) REFERENCES [Web].[Users] (Employee_ID)
ON DELETE CASCADE ON UPDATE CASCADE,
CONSTRAINT FK_Role_ID
FOREIGN KEY (Role_ID) REFERENCES [Web].[Roles] (Role_ID),
CONSTRAINT pk_User_Roles PRIMARY KEY (Employee_ID, Role_ID)
);
The way it works is, when you login, it checks your Username against the Employee_ID in Users table, then goes to the User_Roles table and matches the Employee_ID it got from the Users table to the User_Roles table. Then it gets the Role_ID from the User_Roles table and matches the Role_ID to the roles in the Roles table.
I'm trying to write a stored procedure that does the checks and so far I've gotten close, but I feel I'm missing something. Hoping I can get help with it. This is what I have so far.
CREATE PROCEDURE [Web].[Get_User_Roles]
#Username NVARCHAR(25)
AS
BEGIN
SET NOCOUNT ON;
DECLARE #Employee_ID Nvarchar, #Role_ID INT
SELECT #Employee_ID = #Employee_ID, #Role_ID = #Role_ID
FROM [Web].[Users]
WHERE #Employee_ID = #Employee_ID AND #Role_ID = #Role_ID
IF #Employee_ID IS NOT NULL
BEGIN
IF NOT EXISTS (SELECT #Employee_ID FROM [Web].Users
WHERE #Username = Username)
BEGIN
SELECT
#Employee_ID [Employee_ID],
(SELECT #Role_ID FROM User_Roles
WHERE #Role_ID = #Role_ID) [Roles]-- User Valid
END
ELSE
BEGIN
SELECT -2 [#Username], '' [Roles]--User not activated
END
END
ELSE
BEGIN
SELECT -1 [#Username], '' [Roles]-- User invalid
END
END
Any help to improve this would be appreciated. I put the tables code above so that it's available. My final outcome I shall ask again in this section as well as the middle. The way it works is, when you login, it checks your Username against the Employee_ID in Users Table, then goes to the User_Roles table and matches the Employee_ID it got from the Users table to the User_Roles table. Then it gets the Role_ID from the User_Roles table and matches the Role_ID to the Roles in the Roles table. I'm trying to make a stored procedure that does the checks and so far I've gotten close, but I feel I'm missing something. Hoping I can get help with it. This is what I have so far.

Answer 1

First of all, this part is not going to work at all:
select #Employee_ID = #Employee_ID, #Role_ID = #Role_ID
from [Web].[Users] WHERE #Employee_ID = #Employee_ID and #Role_ID = #Role_ID
You are comparing variables with themselves in the WHERE Statement, you are assigning variables to each other, and you have no Role_ID in the [Web].[Users] table. Try the following
SELECT Employee_ID, Roles
FROM [Web].[Users] A
INNER JOIN [Web].[User_Roles] B
ON A.[Employee_ID] = B.[Employee_ID]
INNER JOIN [Web].[Roles] C
ON b.[Role_ID] = C.[Role_ID]
WHERE [Username] = #Username
This code will return the Employee_id and Roles if you have a user with that username, or an empty data set otherwise.

Answer 2

Still not very clear what you want as output but I think it would be something like this. This will return -2 in the UserStatus column if there isn't a role for the user. Otherwise it will return 1 in that column and the Role. You should just check if there are rows returned when you call this. If it returns no rows then the user doesn't exist.
select UserStatus = case when ur.Role_ID is null then -2 else 1 end
, r.Roles
from Web.Users u
left join Web.User_Roles ur on ur.Employee_ID = u.Employee_ID
left join Web.Roles r on r.Role_ID = ur.Role_ID
where u.Username = #Username