com.jcorporate.expresso.core.dataobjects
Interface Securable

All Known Implementing Classes:

JoinedDataObject, SecuredDBObject

public interface Securable

Interface to described a database object that is subject to security constraints. Expresso treats instances of Securable as something that can be checked on a state by state basis. Expresso uses a global setup value to determine whether non-Securable DBObjects can be granted user access through items such as DBMaint.

All classed derived from com.jcorporate.expresso.core.dbobj.SecuredDBObject automatically implement the Securable interface

Typical Usage:

 Securable s = new com.jcorporate.expresso.services.dbobj.MimeTypes();
 s.setRequestingUid(request.getUid());
 try {
     s.isAllowed("S");
     System.out.println("User " + request.getUid() + " can search MimeTypes table");
 } catch (java.lang.SecurityException ex) {
     System.out.println("User " + request.getUid() +
         " does not have permission to search MimeTypes table";
 }
 

Since:

Expresso 5.1

Author:

Michael Rimov

Field Summary

static int

SYSTEM_ACCOUNT ID for system account.

Method Summary

int	getRequestingUid() Retrieve the uid of the user who's security permissions we're using.
void	isAllowed(String requestedFunction) Throws a Security Exception if the user given by the earlier setRequestingUid() function does not have permission for the given function..
void	setRequestingUid(int newUid) New version of "setUser()" to to speak.

Field Detail

SYSTEM_ACCOUNT

public static final int SYSTEM_ACCOUNT

ID for system account. System account bypasses all security checking in the system for the particular dbobject. So often you need to use it with caution.

See Also:

Constant Field Values

Method Detail

getRequestingUid

public int getRequestingUid()

Retrieve the uid of the user who's security permissions we're using.

Returns:

integer The UID of the user

setRequestingUid

public void setRequestingUid(int newUid)

New version of "setUser()" to to speak.

Parameters:

newUid - Sets the UID for this DBObject. Used for security checks.

Throws:

DBException - if there's a problem switching UID.

Since:

Expresso 4.0

isAllowed

public void isAllowed(String requestedFunction)
               throws SecurityException,
                      DBException

Throws a Security Exception if the user given by the earlier setRequestingUid() function does not have permission for the given function.. However, if a non-dataobject type class implements this interface, isAllowed() may vary depending on use.

Parameters:

requestedFunction - the Requested function String, either A,U,S,D for Add,Update,Search,Delete

Throws:

SecurityException - if the user is not allowed

DBException