Serialization of domain model to JSON based on user roles...

[Marko Rihtar]

Hi,

currently i'm using JSP for presentation layer.
JSP works great with spring security because i can wrap html table columns in <sec> tags i show only columns that logged in user has privileges to see.

Now i'm planing to refactor presentation layer to use javascript DOJO framework and feed tables with JSON using ajax.
My problem is how to limit JSON serialization?
If domain object contains many properties how can i configure serializator to generate JSON witch contains only data from model properties based on current user roles?

Can spring security be used in that way, so i could define access roles on class property level?
If not, are you aware of some framework that has this capabilities?

thx for help,

Marko

[Marko Rihtar]

Never mind.
I found the solution.

thx anyway

[Lsync]

Marko, could you please share your solution? Thanks in advance.

[Marko Rihtar]

Because spring security works well with JSP, im going to serialize JSON using JSP.
Then i can wrap <json : property> tags with spring security <sec> tags the same way i wrap table columns.
http://json-taglib.sourceforge.net/

<%@ taglib prefix="json" uri="http://www.atg.com/taglibs/json" %>

<json:object>
  <json:property name="itemCount" value="${cart.itemCount}"/>
  <json:property name="subtotal" value="${cart.subtotal}"/>
  <json:array name="items" var="item" items="${cart.lineItems}">
    <json:object>
      <json:property name="title" value="${item.title}"/>

      <sec....>
          <json:property name="description" value="${item.description}"/>
      </sec>

      <json:property name="imageUrl" value="${item.imageUrl"/>
      <json:property name="price" value="${item.price}"/>
      <json:property name="qty" value="${item.qty}"/>
    </json:object>
  </json:array>
</json:object>