I'm building a helpdesk-type system, where there are:

  • Customer - can submit/resubmit tickets;
  • Manager - can review submitted tickets, assign to developers (one ticket to multiple developers), review completed tickets, decline then and mark as complete;
  • Developer - can work, close and decline tasks.

For now I have 2 classes:

  • SecurityAuditor where I pass User and Ticket instances. Class decides which action can be performed by that user - canCreateTicket, canEditTicket, canDeclineTicket etc.;
  • TicketManager where I also pass User and Ticket instances. Class performs specific operations (createTicket, declineTicket, startWork etc.). This class also uses SecurityAuditor internally to check whether request operation is approved to be executed.

There is also Project - users can participate in multiple projects, customers and developers can only see Tickets in projects they belong to, Managers can see all projects and tickets.

Sure this all works fine, but I feel like I'm creating god object right here. How can i split this all logically?

  • 1
    with “workflow” do you mean what different users can do ? or a sequence of related tasks ?
    – Christophe
    Commented Mar 19, 2019 at 12:03
  • 1
    Yeah i mean different users can do different things in different times. For example customer can resubmit declined ticket but not if it was declined after it went to development. I used "workflow" because now, each ticket wents through the sequence of statuses and this is how i determine what can be done with it and by whom. Commented Mar 19, 2019 at 12:14
  • 2
    I'm afraid the question is fairly too broad because you are asking how to build a BPM or how to build a ticketing system. Either of the two has an easy answer.
    – Laiv
    Commented Mar 19, 2019 at 13:09

1 Answer 1


Security is a "Cross Cutting" requirement. You shouldn't code it into your classes with the rest of the business logic.

  • Map out your data model
  • create services with the methods you need for your business logic
  • Put a security layer in front of those methods. Either where they are exposed via an Api or in a wrapper.
  • Check whether the user is allowed to call the method by assigning a required Role to the method and checking whether the user is in that Role or not

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.