Access control (DAC)

Some cached rows belong to someone — a portfolio, a business relationship, a user. AbstractDacCache decides on every read whether the caller may see the value, using a gateway that knows who is calling and what they are granted, and a policy that turns grants into a decision. The cached value itself stays neutral, so one copy serves every caller.

Concept

Entitlement-scoped data used to be handled in one of two bad ways: cache per user (a copy per caller, low hit rate, expensive eviction) or filter in every service method (easy to forget). DAC — data access control — moves the check into the cache's exit path:

Five small contracts make this pluggable. CAST is the first provider; any system that can answer "who is calling" and "what may they see" can be another.

A guarded facade

Subclass AbstractDacCache instead of AbstractCache, and pass a gateway and a policy. Everything else — binding, loader, hooks, reads — is unchanged:

@Component
public class DocumentCache extends AbstractDacCache<String, DocumentMetadataSnapshot> {

    private final DocumentMetadataRepository repository;

    public DocumentCache(CacheSupport support, CastDacGateway cast, DocumentMetadataRepository repository) {
        super(DocumentMetadataSnapshot.BINDING, support, cast,
              DacPolicies.anyScope("EDOCS", "READ"), DenyMode.FAIL, DisabledMode.DENY);
        this.repository = repository;
    }

    @Override
    protected Optional<CacheLoader<String, DocumentMetadataSnapshot>> loader() {
        return Optional.of(id -> repository.findById(id).map(DocumentMetadataSnapshot::from));
    }

    public List<DocumentMetadataSnapshot> forCaller() {
        return listByScopes("byPortfolio");
    }
}

The scope of each document comes from the binding, declared on the entity:

@CacheSnapshot(region = "documents", type = RegionKind.TRANSACTIONAL, ttl = "PT24H", domain = "cast",
        indexes = @SnapshotIndex(name = "byPortfolio", property = "portfolioNumber", multiValued = true),
        scope = @SnapshotScope(prefix = "PF:", property = "portfolioNumber"))
public class DocumentMetadata { … }

Now documentCache.get(id) returns the document only if the caller holds EDOCS/READ on that portfolio; forCaller() returns every document on any portfolio the caller is granted, with one index lookup per scope and no filtering code.

Describing what a value belongs to

Scope strings are the shared vocabulary between the data and the grants provider. CAST grants use BR:, PF:, ACC: and GLOBAL (CastUserGrants.portfolioScope(…) and friends build them).

Policies

A policy is a functional interface, so a domain-specific rule is one lambda:

DacPolicy<PortfolioSnapshot> visibleIfNotClosed = (value, grants, scopes) ->
        value.status() == CLOSED && !grants.allows("GLOBAL", "PORTFOLIO", "VIEW_CLOSED")
                ? Decision.deny("closed portfolio")
                : Decision.allow();

super(BINDING, support, cast, DacPolicies.<PortfolioSnapshot>anyScope("PORTFOLIO", "READ").and(visibleIfNotClosed));

What happens on deny, and when the domain is off

The order of checks in afterRead: domain enabled → principal present → perPrincipal key match → grants present → policy. "No grants for caller" is always a deny, even with DisabledMode.ALLOW — an unknown user is not an undecidable case.

Reading on behalf of someone

AbstractDacCache.as(Principal.of(jbUid, "jbUid"), () -> documentCache.forCaller());

Rules

• Cache neutral, decide on exit. Never put the caller into the key unless the data really is per caller (perPrincipal). One copy, many callers, low-cost eviction.
• Guard once. Either the data comes through an AbstractDacCache, or a service method is annotated with @DacAuthorize (next page). Never both for the same data.
• Deny is not an error. A hidden value is the normal outcome for a caller who is not entitled; log at debug, return empty.
• The gateway's grants are cached too. CAST's castUserGrants region is evaluated once per user load; a permission check is a key lookup plus set.contains().
• Domain off = source, not bypass. With dac.domains.cast.enabled=false the facade reads from its source and, by default, denies — the legacy check in the calling code must still run.