Interceptor without transaction participation

[carstenrudat]

Hi all,

I'd like to have some kind of interceptor around a sessionbean-method that clears (set to null) entity properties. I need this feature to have some NO_READ access control on property level.

My first approach was to write a simple ejb-interceptor but it takes part in the sessionbean-method transaction and so the entity's properties was set to null on the database, too.

Is there a way to do such datastructure manipulation with my entity beans without having the database changed? Do I have to write an JBoss interceptor?

Thanks for help.

Carsten

[waynebaylor]

do you normally need read access to the entity? you could remove the get* methods.

[carstenrudat]

Hi waynebaylor,

I'd like to control the read-access based on a users role (and a special use case).

E.g. I have one business case, where a balance of account A should not be visible for users with role "clerk". But in another case balance should not be visible for a user with a role "employee"...

May I use @Permit on entities (anyhow it would not fulfil my needs, but it would be interesting to know)?

Thanks,
Carsten

[waynebaylor]

i haven't tried this, so it may not work :)

First note that it's generally a good idea to wrap access to the EntityManager in an Entity Access Object (EAO), a DAO for entities.

If you do that, then you could use the EAO to return a copy of the entity with whatever fields you need nulled out.

Hope that made sense.