Can Hibernate Search limit results by user accessibility?

Question

I am using Hibernate. I am looking for a free text engine.

Before I investigate into it I need your experience.

I have in my applications user, role and object table. Where a user is connected to one or more roles, and a role is connected to one or more objects.

In my free text search, the user can reach only data that he is allowed to watch by object table.

Can Hibernate search help me with it?

Answer 1

Check this out:

http://lucene.apache.org/java/2_4_0/api/org/apache/lucene/search/Filter.html

I think this is the proper way to implement what you want. Don't really know how is this integrated into hibernate-search, but hopefully there is a way to add a filter to a query somehow.

Later edit:

it looks like there is:

http://docs.jboss.org/hibernate/stable/search/reference/en/html/search-query.html#query-filter

Answer 2

Based on what you have described your model to look like, Hibernate Search will be able to give you what you need quite easily.

It sounds like you are looking for a combination of an embedded index and a filter. I assume that you have a many to many relationship between Object and Role. If so you probably have something like this in Object:

@ManyToMany
@JoinTable(name = "object_role",
            joinColumns = @JoinColumn(name = "object_id"),
            inverseJoinColumns = @JoinColumn(name = "role_id"))
private Set<Role> roles = new HashSet<Role>();

To take the roles and embed them as part of the index created for Object, you need to just put @IndexedEmbedded(prefix = "somPrefixName") above @ManyToMany.

You can then define a filter using @FullTextFilterDef that looks at this embedded index and filters by a given role (which would presumably be the role of the user that is running the search). This will ensure that only Objects related to the given Role are returned by the search query.

In short, Hibernate Search will be able to provide what you need (assuming I understand your requirement correctly). I will be happy to give more detail on how if you would like.

Answer 3

These are two separate problems:

• restricting which content an user is able to search within
• actually searching the content

While for the second problem you can easily use Hibernate Search (that is just Apache Lucene with a bit of integration), for the first one you should concentrate on selecting the right content you want to search before searching it with lucene.

Answer 4

To restrict user to only certain data, i am assuming your data will be mapped to accessible roles. If this is the case, you need to index your role object also. Then use @IndexedEmbedded annotation to with the one-to-many or one-to-one association.

Then you can construct your query like: "text:+ input.getSearchText() + "+role.roleText:" + currentUser.getRole();

This may or may not work depending on how complex your user management system is.