Uncertain how to correctly implement Approve and TransferFrom for ERC20, could you kindly help me to understand?

Question

Having trouble understanding how to correctly implement Approve and transferFrom. Some guidance would be much appreciated, thank you for your time. Below is my Deposit function:

/ Users can deposit DAI to the contract
function deposit(uint deposit_amount) public {
bool withdrawalLock = false;

// Access the contract's state before making the external call
require(withdrawalAllowed, "Withdrawals are not currently allowed");
require(deposit_amount >= MIN_DEPOSIT && deposit_amount <= MAX_DEPOSIT, "Invalid 
deposit amount");

// Use a reentrancy lock to prevent untrusted callees from re-entering the contract
require(!withdrawalLock, "Reentrancy detected");
withdrawalLock = true;

// Approve DAI token
IERC20(daitoken).approve(address(this), deposit_amount);
// Transfer the DAI to the contract
IERC20(daitoken).transferFrom(msg.sender, address(this), deposit_amount);
// Update the user's balance in the mapping
userBalances[msg.sender] = userBalances[msg.sender].add(deposit_amount);
emit Deposit(msg.sender, deposit_amount);

// Unlock the contract to allow future withdrawals
withdrawalLock = false;
}

This selfdestruct function does work if the some DAI is sent to the contract address so i am pretty sure the IERC20 interface is working correctly. However in this case the user should use the Deposit function so they can then call Refund on their own.

// Contract is owned by onlyOwner
contract mortal is owned {

// Only owner can shutdown this contract.
function destroy() public onlyOwner {
    daitoken.transfer(owner, daitoken.balanceOf(address(this)));
    selfdestruct(payable(msg.sender));
    }
}

Answer 1

To deposit funds in the smart contract user should approve the contract to "take" an amount of funds, he must call the approve function (he is the sender of the transaction), and not the contract who calls the approve (in this way he can approve to take all the funds of the user and that's not what you wanna do ), so you have to remove approve inside the deposit function, the user should call it outside the contract and sign the transaction with his private key .

deposit function :

Users can deposit DAI to the contract
function deposit(uint deposit_amount) public {
bool withdrawalLock = false;

// Access the contract's state before making the external call
require(withdrawalAllowed, "Withdrawals are not currently allowed");
require(deposit_amount >= MIN_DEPOSIT && deposit_amount <= MAX_DEPOSIT, "Invalid 
deposit amount");

// Use a reentrancy lock to prevent untrusted callees from re-entering the 
contract
require(!withdrawalLock, "Reentrancy detected");
withdrawalLock = true;

// Transfer the DAI to the contract
IERC20(daitoken).transferFrom(msg.sender, address(this), deposit_amount);
// Update the user's balance in the mapping
userBalances[msg.sender] = userBalances[msg.sender].add(deposit_amount);
emit Deposit(msg.sender, deposit_amount);

// Unlock the contract to allow future withdrawals
withdrawalLock = false;
}

outside the contract :

daitoken.approve(<contract_address>, deposit_amount, {"from": user_account});