Hibernate version: 3.2.ga (annotations+core)

This is more a question on how you guys do it in the real life...

1. I need a validator that checks, i.e. if an user have rights to delete an specific object (he owns that object), for instance, i want to check for:

currentUser.owns(objectToValidate) == true

2. The objectToValidate is provided by HibernateValidator for my validator to check it

3. The currentUser is located in the session scope of my web app

First question: I need to get access to this current user but without making use of any ThreadLocal variables (nasty IMHO...), any tips on how to do it?



Second question: What would make my day is a way to allow HibernateValidator to inject its dependencies in my validator as I needed them. I could provide the validator a IoCProvider that would do the job...

I don't understand. You want to generate a validator exception if the user does not have the right to delete the object, but HV describe domain model constraints, not really operation constraints (ie what if you have an object not targeted to be deleted, will you also raise the exception?)

It makes sense... how do you implement such operation constraints using Seam? Programatically doing it?

Security will be handle through a set of rules (think JBoss Rules). That's the idea floating around.

Rules will solve it for adding/removing/so on...

What about filtering resources, would it make sense for me to give the Query object (im using jpa) to the rule engine and leave it to add the string part which filters only objects for that user? ... too much "string" for me...

The idea is....?

you can use Hibernate Filters
But that has nothing to do with a Validator, or I don't understand what you are saying

You are right... I first though about using validator... but I have seen that it doesnt make sense.

Filters seems like the right way to go...

Thanks once again