Reloading JSP for a specific role's users

Question

Hi all,
We have a web application using JSPs.
Our application has users and roles. A user is associated to a role. These are defined in 2 tables:
create table role
( id int not null primary key,
  name varchar(50) not null )
create table user
( user_name varchar(50) not null primary key,
  user_password varchar(50) not null,
  role_id int not null foreign key references role(id) )
For example:
insert into role values (1, 'HR')
insert into user values ('michaelK', 'password', 1)
insert into role values (2, 'Payroll')
insert into user values ('babarA', 'honest', 2)We have 2 tables where we store all our application's web pages and buttons on each page:
create table web_page
( id int not null primary key,
  name varchar(50) not null )
create table web_page_button
( id int not null primary key,
  name varchar(50) not null,
  web_page_id int not null foreign key references web_page(id) )
For example:
insert into web_page values (1, 'Personal_Info') // "Personal Info" Screen has 2 buttons: update and cancel
insert into web_page_button (25, 'update', 1)
insert into web_page_button (26, 'cancel', 1)We have a requirement that the administrator want the facility to enable/disable buttons on each web page for a specific role. So we have created a table where we define enable flag for each button of a web page w.r.t a Role:
create table role_web_page_button
( id int not null primary key,
  role_id int not null foreign key references role(id),
  web_page_button_id int not null foreign key references web_page_button(id),
  enable_flag int not null )So if the administrator say that for users belonging to "Payroll" role the "Update" button on "Personal Info" Screen will be disabled.
insert into role_web_page_button values (100, 2, 25, 0)The user first go to login.jsp and provide login information. If successful we store his user_name and role_id in the session as an attribute. We then redirect the user to index.jsp. In this jsp we have a header.jsp on top. This JSP remains there on all web pages user visit.
In that JSP we generate one Javascript function getButtonEnableFlags(). This function defines each button's enable flag of each screen for the user's role_id. So when a user of "Payroll" role logins then this is generated:
function getButtonEnableFlags()
  var buttonEnableFlags = new Object();
  buttonEnableFlags["Personal_Info::update"] = "0";
  return buttonEnableFlags;
}We also have a javascript function which tells us the enable flag's value for a button of a screen.
function getButtonEnableFlag(webpageName, buttonName)
  var buttonEnableFlags = getButtonEnableFlags();
  var keyName = webpageName + "::" + buttonName;
  return buttonEnableFlags[keyName];
}Each Web Page after loading calls a common javascript function setupButtons(webpageName). This function receives a webpage name, picks all buttons on the form of that web page, then call getButtonEnableFlag(webpageName, buttonName) to get enable flag for each button and then set it.
This solution is working fast and perfect. The javascript function getButtonEnableFlags() is generated once when user logins so each web page does not have to call the server to figure out enable flag for their buttons.
I have created a maintenance screen for the Administrator which provides the facility to enable/disable buttons on each web page for a specific role. This screen updates the role_web_page_button table.
Problem is if the Administrator makes any changes for a Role how can I reflect that change on the user's of that role which are already login in the system? For example suppose 2 users of "Payroll" role are login in the system and for "Peson_Info" web page the "update" button is disabled. Now administrator changes the "update" button of "Personal_Info" web page to enable for "Payroll" role through the maintenance screen. How can I reload the header.jsp on only those 2 user's computer?
Thanks

Answer 1

I suppose you can use AJAX to change the end-users JSP page that is displayed on his browser as he is vieiwing it.
However, I suggest against changing permissions on a JSP page while the user is using it (I believe most programmers do not do that). If I was an end-user with a JSP page displayed and I suddenly see the 'update' button disapear, I would be very upset.I suggest waiting for the user to close his session (and not simpily navigate to another page within the session, but actually ending the session by either calling up another web site or closing the browser) and when he next logs into the applcation again, the button is gone. If the administrator does take away a permission such as an 'update' button, do you really need to deny permission to everyone right then? I think you can wait for users to log off.
An alternative is to create a batch job that when the admin removes permission, the batch job runs at midnight to actually change the permission in the database. Since few people are logged on at midnight, few people will see the change while they are working.
Another possiblity is when they click the update button, don't do an actual update to the database. Instead, redraw the page with the update button disabled (not removed) and add a note on the JSP page that the administrator has just removed permission for all users to update at this time.