Lucene and access control (visibility of comments)

Question

Imagine this simple scenario for full text search: Articles with Comments. I want to search articles also by text in comments. That alone is fairly simple to implement.

Not all comments are visible to all users though. User that writes comment can also restrict it's visibility to concrete Role (so comment has 2 fields: text and role).

Is it possible to restrict lucene search on articles so it looks only inside comments that are visible for current user (comment.role is inside set of current user's roles)?

If so, please point me to the right direction how should I go about it and write such query (preferably) or lucene filter.

(I'm using lucene through hibernate-search but it should make no difference)

Answer 1

According to the docs, you can just give the role that you are interested in as another field in the query. In your example, something like this should work:

text:"user query" AND role:"userRole"

Answer 2

Adding to joeslice's answer. If there is a hierarchy of roles where permission to a role cascades that permission to other roles up in the hierarchy. For example, if permission for role "manager" is granted resulting into permission for "director" & "vice president" as well.

In this case, your query will be

text:"user query" AND (role:"role1" OR role:"role2" OR role:"role3")

Answer 3

I can't think of any good solutions to this situation, but I can come up with some bad ones...

The problem is that lucene doesn't really provide any hierarchy support other than the document-field mechanism.

Your best bet is to create a separate document for every comment. That way every document has one "text" and one "role" fields, so you know that the role applies to the text.

The problem is that now you don't have a good association between comments and article, so for example, if you have an article that contains the word "hibernate" with a comment containing the word "lucene", a search for "hibernate AND lucene" will not find it. You can try to improve on this by including the article and all the comments as extra fields in every document, but then you'd have a really bloated index, and possibly security implications.

Another way to approach this is to have numbered fields like comment1, comment2 etc. Then you can match role1 with comment1. If you have more than a few comments on an article this will make your queries big and inefficient.