Hi,

we would like to use the Hibernate 3 Virtualization feature to implement data-dependent access restrictions. These access restrictions are defined for a specific user group. For each restriction, a specific filter is defined.

=> All filters of a specific group have to be combined via AND. This is what Hibernate does if you add multiple filters - excellent.

=> A user may be in several groups. For each group, the filters must be instantiated using specific parameters. The sets of filters for each group must be combinded via OR.

Example: Think of a store selling goods of several categories in several countries.
- The user group "car_germany" is allowed to read/write goods of category "car" and country "germany".
- The user group "fruit_spain" is allowed to read/write goods of category "fruit" and country "spain".
- Mr. Smith is assigned to both groups.
The filters instantiated for Mr. Smith would look like this:
((good.category = "car") AND (good.country = "germany")) OR
((good.category = "fruit") AND (good.country = "spain"))

A general concept to realize this would be a hierarchy of filters, which can be combined via AND or via OR.

My questions: Is there a way to realize this with the current version of the Virtualization feature? If not: Is it intended to support those filter hierarchies in one of the next Hibernate releases?

Regards,
Christian