-1

I am creating an application where users can create games. I am storing in the entity Game who was the user that created the game, I mean, the owner of the game. The entity Game has some relationships ONE_TO_ONE (RuleGame) and ONE_TO_MANY (PublicZone and PrivateZones) to other entities.

What I want is that only the owner of the game and users with ROLE_ADMIN and ROLE_STAFF be able to edit the game and its relationships.

Another way to say this, think like a Social Network, just me and the ADMIN can edit my profile but I cannot edit the profile of other users.

Of course I can create my own logic in a @Service and in each "update" method of the controller of those entities (Game, PublicZone and PrivateZones) call it and check this but I am wondering is there is a better way to go.

I was reading about Audit, like Hibernate Envers, but it is for wiki-like software, log who added/updated/deleted, so it doesnt fit in what I need.

I am using Spring 4.1.6, Spring Data Jpa 1.8.0, Spring Security 4 and Hibernate 4.3.8

Every suggestion is welcome!

Pedro Gonzalez
  • 180
  • 1
  • 2
  • 11
  • 1
    Google is your friend:http://blog.countableset.ch/2014/03/08/auditing-spring-data-jpa-java-config/ – Terry May 15 '15 at 20:46

1 Answers1

0

You will want to use spring-data-jpa auditing along with a security framework such as spring security. This will allow the username to be added automatically when a record is created and modified with no extra logic from yourself.

jax
  • 37,735
  • 57
  • 182
  • 278