Re: Mapping SQL Result Sets to Browsers

Nathan Andelin wrote:

I guess the point, is that you may need to plan for a lot of flexibility, and change as business rules change.

Agreed. I'm sort of avoiding this very high-level discussion of architectures because I've already been there and done that and I have my own opinions, and rather than bollox up the list with my pontification I'm enjoying the interplay (hence the "from the bleachers" comment). But hopefully I can help people avoid certain pitfalls I've encountered.

Different rules for different object types is important. The OO answer is to have different classes for each, but all of a sudden you end up with a complex and fragile object hierarchy. Not necessarily a bad thing, just something that happens and is not always handled well by ORM software.

An even trickier issue is when you get different values for different users. One specific example is social security numbers. In at least one system I've seen, a user with high authority gets to see the real SSN, while someone with a lower authority sees a special garbled value. Technically I suppose this is a presentation layer issue and the object could contain both values, but then you have security concerns. In any event, it's something that needs to be considered.

In any case, you're right - once you begin injecting business rules into the ORM layer, a large number of issues come into play. Everything from authorization to latency needs to be addressed.

Joe