OO Design Problem

[Rick Rangers]

Hi,

I'm new to OO and Java and I have a problem with the design of my simple web application. What is does it this: when a user fills in a form with criteria it gets a list of projects from the backend system and displays this to the user. If the user is authorized to edit a project an edit button appears next to the project so that he or she can do so.

In order to get the list of projects a created a "projects service" which gets the projects from the backend system. Every project has an property called isEditable which is needed in the JSP to display the edit button or not. The criteria for a project to be editable is that either the user is the owner of the project or he/she is in the same department as the owner of the project.

The way it is setup now is like this: the service knows who the user is and what the department of the user is so it sets the property of the projects accordingly. In other words: the service is responsible for setting deciding wheter the project is editable or not.

e.g. in the service: if (......) { project.isEditable = true } else { project.isEditable = false }

An other solution would be that the project itself would decide whether
it was editable or not , which sounds elegant to me but then every project would have to know who's asking this and to which department this person belongs:

e.g. project.isEditable( userName, department)

Which is the best (OO) solution?

Regards,
Rick

[Stan James]

Neat question. A method description in the model that says "Returns a list of projects and the edit flags for one specified user" sounds funny to me. "Returns a list of projects" or "Returns a list of projects meeting some search criteria" sound better. That criteria might include "editable by specified user" but that wouldn't return all projects.

I guess that leaves you determining the edit flag after you get the list. I'm going to be a coward and wait for more votes from the gang before thinking how I'd want to do that.

[peter cooke]

Sorry I am thinking in terms of my last job.

Third option assign every project a role or resource name.
Each user would be given a list of role/resource names that they have access to.
[ February 06, 2007: Message edited by: peter cooke ]

[Rick Rangers]

I guess that leaves you determining the edit flag after you get the list. I'm going to be a coward and wait for more votes from the gang before thinking how I'd want to do that. [/QB]

Thanks for responding(everyone)!

I'll try to describe better what the current situation is: my portlet asks from the service a list of projects meeting certain criteria. Being editable is NOT one of them. However, the service asks the underlying DAO for the list and then loops through the list and sets the editable property accordingly. Then the list is put on the request and displayed by the JSP.

My question: should the determination of a project being editable put in:
a) the service (where it is now)
b) in the portlet (ask the service for the list and then set the editable flags). However, I'd like to make my portlet code as short as possible because that makes it easier to maintain.
c) in the JSP, by the project itself. In this case the project needs to know who the current user is and what department the user is a member of. Of course the portlet can put this info on the request too for use in the JSP but my guess is that the JSP is going to be a bloody mess!

Any suggestions will be appreciated!

Regards,
Rick
[ February 07, 2007: Message edited by: Rick Rangers ]

[Stan James]

There might be some level in between portlet - which I assume is solidly in the presentation layer - and the model. The model has fairly fine grained operations - get the list, check user's permission to edit one project - but the presentation wants a single larger grained result with combined list & permissions. I probably wouldn't start out calling this a whole "layer" between presentation and model, but a special-use corner of the model that aggregates fine grained things into larger grained things. Maybe that will turn into a layer of Facades. Or not. Doodle that up on a white board with a couple friends and see if it sings or just sits there. The effort it takes to explain it to them will tell you a lot about how it might work.

[Andrew Laughlin]

Hi Rick,

This is an interesting problem. I don't know that I have a solution, but sometimes a different set of eyes on an issue can point you in the right direction.

I see two classes, User and Project. The User class' access level in regard to a Project class is determined by some set of rules ( same dept, etc..). Adhereing to the "Single Responsibility Principle" (http://www.objectmentor.com/resources/articles/srp.pdf) it seems to follow that class User should know about users and class Project about projects. The relationship that defines the security between these two entities seems (at least in my mind) to exist outside both entities. Therefore a separate entity should mediate access control. This separate entity could be the service, as is currently, or another object. It seems a valuable design goal would be the ability to change the security requirements without affecting or having to change the User and/or Project classes. Are future requirements going to necessitate more granular control beyond a Project simply being �editable�?

It seems in your scenario, Projects are always editable, it just depends on who's asking. This lends itself to the ACL model implemented on various resources in most modern operating systems.

Let me know what route you decide on.


Best Regards,
Andrew

[Enn Ares]

Here is another thought on this:

In the GetProjectsAction class I would have these two steps:

1. projectSvc.getProjects()
2. foreach project
- check whether sessionUser is projectOwner
- set isEditable property

- Enn

[Rick Rangers]

Hi everybody,

Thanks for the replies so far! I've decided to put the responsiblity for setting the editable property of a project in the service. The main
reason is that, well..., it's there right now and it works (Maybe not a strong argument but....)

Are there any good books on OO design? What I'm looking for is a book
with a lot of "cases" where the author presents many problems and different
solutions for these problems. So far, the books I've seen just cover the basic (inheritance, polymorphism etc, patetrns) and go straight to how to present the solution in UML, whereas I'm more interested in getting a "feel" which classes to design and what these classes should or shouldn't do and why.

Any thoughts on this matter are appreciated!

Regards,
Rick

[Ilja Preuss]

"Agile Software Development - Principles, Patterns and Practices" comes close to what you describe.

When you have read that, "Refactoring" and finally "Refactoring to Patterns" provide more fodder on how to organize responsibilities between classes.

All of those, especially the first two, should be required reading for all serious OO developers, in my not so humble opinion...

[Rick Rangers]

Thanks Ilya for the tips. I�ll definately order those
books you mentioned!


Regards,
Rick

[Ilja Preuss]

It just occured to me that before reading "Refactoring to Patterns", you probably should read a book an the GoF design patterns. Not sure which one I would recommend, though...