Page Comparison

public class Permission {
  String guid; // synthetic key makes create/add/update APIs easier
  String appId; // most permissions except system-wide, and usually implicit
  String userId;
  String roleaccessLevel; // "admin", "developer"
  String permissionTypeentityType; // "study", "organization", "app", "system"
  String objectIdentityId; // "studyId", "orgId", "appId"
  
  // Suggested toString() descriptor (implicitly scoped to an app):
  // "2rkp3nU7p8fjUTDVIgjT6T ∈ {organization:sage-bionetworks admin}"
}

// Each type relates to a specific entity and its ID (indicated in the constructor)
public enum PermissionType {
  ASSESSMENT (ASSESSMENT),
  STUDY (STUDY),
  ORGANIZATION (ORGANIZATION),
  SPONSORED_STUDIES (ORGANIZATION),
  MEMBERS (ORGANIZATION),
  ASSESSMENTS (ORGANIZATION), // ASSESSMENT_LIBRARY?
  STUDY_PI (STUDY),
  PARTICIPANTS (STUDY);
}

interface PermissionsService {
  Set<Permission> getPermissionsForUser(String appId, String userId);
  Permission addPermission(Permission permission);
  void updatePermission(Permission permission);
  void removePermission(Permission permissionspermission);
  Set<Permission> getPermissionsForType(String appId, PermissionType type, String id);
  //
this delete may/** notSpring besecurity cascadedwill byneed a thevery databasefocused andmethod wouldto thencheck, for a 
// need to be done* manually.given user and voida deletePermissions(Stringgiven appIdobject, PermissionTypedoes type,the Stringuser id);have any of the required 
/** Spring security will need* aroles very focused method to check, for a 
    * given user and a given object, does the user have any of the required 
    * roles to to perform the request. This method can fudge things like 
    * app-scoped permissions, too.
    */
  boolean isAuthorizedAs(AccountId accountId, PermissionType type, String objectId, Role... roles);
}