Security Rules + EJB-QL + data listing : what is the best way

[balazska]

Hy!

What is the best way to listing only those entites by an EJB-QL, where the security hasPermission expression is successful.

Is there something official method?

I'd like to avoid this : normal query than manual selection with hasPermission with a for cycle.

thanks so much!

[balazska]

so, the main scenario is to get 5 entities (query setMaxResult) with the EJB-qL, where the hasPermission(entity,'rule') is ok.

Thanks, for any advice!

[shane.bryzak]

You can use Identity.filterByPermission() to do this.

[shane.bryzak]

Actually after reading your question more closely, I should point out that this will only filter the query results after they've been fetched.  Unfortunately this is the only option here, unless we come up with some really powerful magic that can rewrite the query.

[balazska]

thanks for your reply!!!

But, I think it would be a common scenario, so I am at a total loss with this issue. :(

[shane.bryzak]

It most certainly is a common scenario, however there's no easy way to achieve this in a generic fashion.  What you could possibly do in your specific case is perform the join manually between the entities in your query and the permission table.  It's a little messy, but should produce the result you need.

[balazska]

thanks so much!

How can I get and join the permission table if I just want to use a hasPermission(entity,'rule') expression.

[shane.bryzak]

You can't use the hasPermission() expression, you need to write your query so that it does an inner join to the permission table for the entities in question.  I.e. join on the target value,  and constrain by the action that you want to check.

[balazska]

Can you write a little code sample, to be clear for me.
thanks.