Role based or shopping cart style Java bean binding?

Question

I have a POJO that I would like to expose as XML from a web service, preferably with JAX-B.

The fields that need to be exposed in XML depend on what type of user is making the request. For instance, we have a role for HumanResources and Finance users. A User might be defined as:

@XmlRootElement

public class User {

@XmlElement public String someHumanResourceData;

@XmlElement public String someFinanceData;

}

I want HR users to see the HR data, and Finance to see the Finance data, but nothing more than that. HR should not see Finance data.

Is there a recommended approach on how to do this? What are some search terms I could use to lookup more information on the Web?

A few ideas that I don't find appealing: 1) I could use subclassing to expose a FinanceUser and HumanResourceUser that only has the relevant data, and a parent User with the shared data. However, this is fragile and may work on a small example, I feel I need a more flexible, compositional approach for production. 2) A co-worker recommends a "shopping cart" approach in which the client requests what fields he/she wants with each request. I'm not finding a standard way to do this or even many other people who have done this approach. It sounds really home-grown and labor intensive to me.

Any other ideas?

Answer 1

Why don't you just check the user's role in your server-side web service implementation?

What is your web service interface?

public interface DarcysWebService {
    public HumanResourceResponse getHumanResourceData(Authentication a, HumanResourceRequest req);
    public FinanceResponse getFinanceData(Authentication a, FinanceRequest req);
}

I would then check the authentication data supplied (username, password) against your database of users (uuid, username, password, role), and then use the role to determine whether the response is a message saying "Error - you don't have access privileges" or to actually populate the data fields/objects in the response with the requested data.