title: Security filtering entity collection with jax-rs and jersey
body: <p>I've been looking around on how to filter results based on certain security roles. I've been looking at filters but this just seems to filter out certain fields rather than the complete entity itself. Let me try to explain what I need. Lets say I have 2 entity classes:</p>
  
  <pre><code>public class Project {
  
     private Long id;
  
     private String name;
  
     private String description;
  
     // getters and setters
  }
  
  
  public class User {
  
      private Long id;
  
      private String name;
  
      private String email;
  
      // getters and setters
  }
  </code></pre>
  
  <p>resource:</p>
  
  <pre><code>@Path("projects")
  @Produces("application/json") 
  public class ProjectsResource {
  
      @GET
      public List&lt;Project&gt; getProjects() {
          return getDetailedProjects();
      }
  }
  </code></pre>
  
  <p>Also I have 2 companies, each with their own projects. For convenience lets call them company A and company B.</p>
  
  <p>What I would like to achieve is that 3 users all using this same resource get different results based on their security role.</p>
  
  <p>User 1: the Super user, should get everything</p>
  
  <p>User 2: manager for company A, should only get projects for company A</p>
  
  <p>User 3: manager for company B, should only get projects for company B</p>
  
  <p>How should I go about doing this? It just doesn't seem right to do this filtering in each resource.</p>
  
  <p>I'm using jax-rs, with role based security. Users are linked to a role which grants them access to projects for a specific company.</p>