Complete business server/client framework?

Question

We would like to know which free and well-documented solutions we can use for:
- persistence framework
- business data object distribution from server to clients including change notification, server and client side caching and client side locking per user.
- (hacker) security for the above
- User/group based rights.
- Swing MVC framework
- Creating Swing data entry component with default functionality such as save, undo/redo and change checking.
Details below...
We have made an in-house client/server banqueting program from the ground up in (almost) pure Java. It is NOT web based, and we don't have any experience in using J2EE technologies (except for connecting to a mail server). What started out small became a quite large application that works nicely but is hard to maintain. It is time to do some major refactoring.
I dare to claim that almost all the problems we are facing (see below) can be found in any serious client/server business application.
Having said that, I find it quite difficult to find the right solutions for our project in the large place that is the internet. It would be a waste to spend days learning something only to find out it is not the way to go.
So I hope some of you can kindly suggest the right Java frameworks to solve our problems and reduce our ad hoc spaghetti code... Preferably, these frameworks should be used by many other developers and be well documented.
Current architecture:
Server:
Connects to a MSSQLServer database, creates POJO data objects (mapped mostly 1 on 1 with DB tables) and can provide these objects and simple reporting services (PDF, Word XML) to multiple clients over RMI.
The "writable" objects that clients request can be locked by a client before saving. When a client saves, or when the status of the lock changes, an event is pushed to all clients.
Client:
Connects to the server with username + password.
Uses Swing to show components like: a calendar with reservations, a reservation entry screen (including products), a customer entry screen, a product screen, etc...
Internally our system is much more complicated than it should be.
Some of the current major flaws:
1) adding a new table/object requires adaptation of at least 4 classes on the server and one HUGE data access class on the client and the creation of 4 different MSSQL stored procedures (selecting, saving = inserting, updating).
2) logging in over RMI is not done over an encrypted channel.
We have some concerns with the security over RMI (and our use of it).
* Is it possible for a hacked client to inject code into the server?
* It may be possible in our design that clients can spoof being another user.
* When a client saves an object, the server pushes this object to
all the other clients using remote method calls from server to the other clients. If I'm not mistaken we have to be very careful with RMI that one of these clients cannot block the code execution by not returning from this call...
3)We would like to have user groups that have rights for specific
objects such as allow nothing, allow read, allow write, etc...
4) our client side data access class does not automatically provide caching requiring us to create more or less ad hoc caches
5) Swing does NOT have a strict (enforced) model-view-controller architecture. Our client has severely mixed application logic with representation logic.
6) We have a few Swing components for data entry in data Objects we request from the server. They share functionality (and buttons) such as save, reload and popping up messages like "do you wish to save the changes?" none of these default functionalities have been abstracted, so it's often a matter of copy/paste and cluttered code.
When properly abstracted to a model undo/redo functionality might also automatically possible without extra programming...
To overcome point 1) we could use an Object to Relational mapping framework such as Hibernate or Cayenne.
To overcome point 2) and 3) we would like to be able to distribute the objects to the clients on the clients demand. The framework for this should include client side cache and the possibility for locking an object and receiving notifications from the server when another client changes the object.
(It would also be nice if all logged in clients can listen to a collection of objects (e.g. Products) and get notified when some client adds a new product without needing the lock on the Product collection.)
Preferably this framework should be hacker proof.
To overcome point 4) we would like to have an MVC framework for Swing with which we can bind fields in a data object or model to a view. When data is entered in the view the model is automatically updated and other views are updated, without the need of all those Swing specific listeners. Whenever the data is updated programmatically the views are also automatically updated.
For this I found JStaple as part of Cayenne, but I don't know if this is a mature and well-documented system.

Answer 1

After a day of checking out the Cayenne tool I have discovered that it works very well for creating a client/server "persistent" application (including web support through Servlets/JSP).
There is no such thing as "pessimistic locking" of objects and notifications of other clients though... This is a major drawback, so the quest for a great framework isn't over yet...
Edit: Spring Framework!!!
After a lot of time researching I am coming to the conclusion that (at least) using the Spring framework is the best bet.
The Spring Rich Client Project has a sample client application which can be run on top of their sample webserver application (PetClinic example).
http://spring-rich-c.sourceforge.net/
Spring can integrate with just about any Java libraries, frameworks and API's available, and has thought about almost all of the concerns I have.
The beauty is, that many concerns can be configured transparently using XML files and do not clutter your code (think about Acegi security, transaction management, etc...). This also enables you in easily switching many technologies. (e.g. if you use Hibernate/JPA switching a db is as easy as changing a few lines of settings.)
There are however a few things I am still missing:
* Undo/redo support in the client (preferably transparent to your code)
* Pessimistic locking at the application level. For this I might work together with people from the Terracotta "distributed virtual machine" (which also looks like a very good solution for scaling existing applications), or check the Spring forums if something like that has already been implemented.
Edited by: Strider80 on Nov 22, 2007 6:05 PM