Access control using Spring Security in ExtJS client?

Question

I am using Grails 1.3.7, Spring Security Plugin for Grails, and ExtJS 3.3.1. I will have about 20 roles in my app and use static URL rules to secure my controller layer. My client side will be all ExtJS, as I just started with ExtJS, I'd like to check with you folks there and find out what is the proper way of integrating access control into ExtJS client side. Basically, how to organize the code that determines which part of the UI to display for a given user? And further more, some form maybe read-only for some users.

Answer 1

In our application we have a JSON encoded user object that contains the Roles/Entitlements for that user. These are embedded in the page header on load so that they're available globally.

Then, there is a hasEntitlement(userObj,Entitlement) function that tests for a specific entitlement in the userObj we embedded. So, all ExtJs actions in the page check this before taking an action, and all buttons' 'disabled' properties are set to this function call on init.

Of course we also check all of this server side before processing a request from the UI using Spring method level security, so if someone hacks the JS on the front end, they have not compromised the back end.