I’m writing a GUI application that will have a user log in feature. Each user will belong to (at least one, possibly more than one) group and each group will have attributes indicating if certain rights are allowed or not allowed. The list of rights will cover things like editing things from the past, printing, deleting data, etc. Lots of different actions can be handled by the same right (printing can be initiated both from the menu and from the toolbar, for example).
My question is: what is the best way to implement this security system? Should every action have a Boolean isSecurable attribute and list of rights required? How should the checking be done, by a central structure, or should each action check for the required rights itself?
I’m aiming for correctness here. I know I can hack together a working system quickly but I’d like to have something that won’t cause problems down the road. I’m sorry for the verbose explanation but I’m not even sure what to call what I’m looking for.
Edit: This isn’t really GUI-specific, I think, but I’ve researched quite a bit for info on this and most of the stuff I find is for web applications, or general ‘secure programming’ tips.
‘BCS’ is correct that the security checks should not be tied to the GUI, that should be tied to the underlying actions/operations/methods you’re invoking. In an MVC framework, that would be in the Model, or elsewhere, in the actions invoked by the Model.
If the dispatching of your actions is certain to pass through some common mechanism (e.g. all share a certain base class), then putting the security checks there is a good way to cover all the bases.
One additional thought: What you describe as groups may or may not be ‘roles’ in security terminology.