Java，处理对象权限

Question

A few days ago I got an assignment to make (amateur) model of my universities course and student management system (just core program, no gui) . I was successful in creating almost everything, except one part, permission. I have no idea where to even start this. So class Course has tons of methods, but each of them should work differently. For example if student wants to enroll in a course, whose enroll deadline has passed, he can only enroll if Professor adds him manually. I set up the method, which checks dates and returns error if student tries to enroll too late. But, if object professor would to call that method, he could 'override the rules'. My professor told me to think about using interfaces, but I've been banging my head against the wall for a while now, and I still have no idea how to use interfaces to set permissions.
EDIT: my apologies, I forgot the question. What is the best way in java to create and control permissions. If it happens to be interface, how exactly could I use interface to do this?

Answer 1

What if you had an interface the method

public void studentEnroll(Student s);

and another interface on the processors can access which is

public void professorEnroll(Student s);

There are so many ways you could do this. I suggest you try thinking about what the simplest solution would be.

Answer 2

You might need to provide more information for how the system knows who is executing each method in your system. I'll assume you pass the User object that represents who is calling a method (there are other ways, but this illustrates the point without talking about a lot of architecture you might or might not use/need).

public class Course {

    public void enroll( User user, Student student ) {
       if( user.hasPermission( Permission.OVERRIDE_COURSE_RULES ) ) {
           add( student );
       } else if( hasEnrollmentDatePassed() ) {
           throw new CourseException( "Enrollment date has passed." );
       } else if( isClassFull() ) {
           throw new CourseException( "Course is full" );
       } else {
           add( student );
       }
    }
}

Few things to note: User doesn't depend on Professor, Student, etc. User could be a concrete class or an interface that Professor, Student, etc implement. You don't want to tie your permission system to Professor and Student because your permission mappings cannot change if you do that. That means if you later want to allow say a TA or Grad Student to override the rules for adding students you can't change those permission mappings without modifying code. So always use 'verbs' or actions for permissions. Map a set of permissions to a User then don't check User types use those verbs to enable functionality.

Answer 3

You could have a design like:

class Course
{
   public void enroll(Person actionGenerator, Student student) 
   {
      if ( actionGenerator instanceof Professor )
      {
          //bypass verification
      }
      else
      {
      }
   }
}

interface Person
{
   /*....*/
}

class Student implements Person
{
   public void registerStudent(Course c)
   {
      c.enroll(this,this);
   }
}

class Professor implements Person
{
   public void registerStudent(Course c, Student s)
   {
      c.enroll(this,s);
   } 
}

Answer 4

I find that people often confuse the classes/actors inside the system with the people/actors outside the system: They'll say that "We can't trust the Student class to hold the student's cash balance because we can't trust (human) students with that; they could lie!" Remember: You control the code you put in the Student class, and what it does. The actual students do not program the instances that represent them. Same for the Professor class.

So, generally speaking, you impose security and permissions based on the process you design. IE: How you define and use the methods of your classes.

Your system needs to know if a student is enrolling in a class directly, or if the class' professor is enrolling them. This would generally imply that the system must know if the person currently logged into the system is a student or a professor. It might make sense to provide professors with different screens which call different methods.

In production code, I would probably use Thread Local Storage to track the current user's permissions. But that's probably a bit much for a student assignment.

Honestly, I don't see how introducing Java interfaces would help. Thinking carefully about the interfaces (methods) that you use and when you use them would probably help.