Question

‘Hi —

I’m changing the way I build my UI from this:

If ( role == ‘Admin’ ) myComp.visible = false;

…to a totally dynamic UI based on what is returned from the DB. I’m architecting the best approach to this now.

I’ve read about role-based access control and understand that it’s best that the server generates the UI after a user is authenticated, but apart from re-doing the entire backend to store MXML et al., is there a better approach?

Is it a bad idea to have a Permissions object that has properties like:

showTabOne:Boolean = true;
allUserToEditGrids:Boolean = false;

The components visibility and includeInLayout properties will be bound to these values.

The UI will also allow a user to create new roles and set permissions.

The only drawback I see is that every time a new feature is added, the app will have to be recompiled to update the bindings.

Any tips are greatly appreciated.

Thank you!

Answer 1

Permission object is fine, if you have complex enough policy, it is natural to abstract it into its own class. About recompilation – bindings can be set in runtime (BindingUtils), maybe you can use it to avoid it. Not sure what is

re-doing the entire backend to store
MXML

Normal way would be MXML controls composed after the authentification, indeed.