Restrict acces in DTO class for fields and return different value

I'm implementing authorization in my Spring Boot application. And I want to apply authorization to dto's.

See the class below

public class ExampleDTO{
    private String phoneNumber; // want to restrict acces on this field.
}

E.g.

User A with permission A can see phoneNumber 123456789
User B with permission B can see phoneNumber 123456***

A solutions can be something like this:

public void setPhoneNumber(String iban) {
    if (Service.checkPermission("A")) {
        this.phoneNumber= 123456789;
    } else if (Service.checkPermission("B")) {
        this.phoneNumber= "123456***";
    } else {
        this.phoneNumber= "*********";
    }
}

But this is against the OOP principle.

Also I can do this in a service:

public ExampleDTO getExampleDto(String iban) {
    if (checkPermission("A")) {
        return ExampleDtoA;
    } else if (checkPermission("B")) {
        return ExampleDtoB;
    } else {
        return ExampleDtoC;
    }
}

But this will allow code duplication;

So does one of you have a better solution?

One way to go is to use a builder to build ExampleDto. Something like this:

public class ExampleDTOBuilder {

    public enum PhonePermission { A, B, NONE };
    
    private String phoneNumber;
    private PhonePermission phonePermission = PhonePermission.NONE;
    
    public ExampleDTOBuilder setPhoneNumber( String phoneNumber ) {
        this.phoneNumber = phoneNumber;
        return this;
    }
    
    public ExampleDTOBuilder setPermission(PhonePermission phonePermission) {
        this.phonePermission = phonePermission;
        return this;
    }
    
    public ExampleDTO build() {
        ExampleDTO dto = new ExampleDTO();
        
        switch (this.phonePermission) {
        case A:
            dto.setPhoneNumber(this.phoneNumber);
            break;
        case B:
            dto.setPhoneNumber(getMaskedPhoneNumber(this.phoneNumber));
        default:
            dto.setPhoneNumber("********");
            break;
        }
        
        return dto;
    }
    
    private String getMaskedPhoneNumber(String phoneNumber) {
        return "123***"; // do your masking
    }
}

Use:

ExampleDTO dto = new ExampleDTOBuilder()
        .setPermission(PhonePermission.A)
        .setPhoneNumber("123456")
        .build();

More details about the Builder pattern can be found here: https://en.wikipedia.org/wiki/Builder_pattern

I am assuming that you are saving these phone numbers in a database and that you want to persist the real phone numbers, but return different values based on permissions.

If this is the case, then you should not alter the setPhoneNumber method of the DTO as this could put the following phone number values into your DB: 123456***, *********.

You can encapsulate the logic in a converter between your entity and dto layer

public class ExampleService {
    ExampleDto getExample(String iban) {
        // Get entity from your DB
        ExampleEntity entity = entityRepository.getEntity(iban);
        return converter.convert(entity);
    }
}

public class Converter {
    public ExampleDto convert(ExampleEntity entity) {
        ExampleDto dto = new ExampleDto();
        if (checkPermission("A"))
            dto.setPhoneNumber(entity.getPhoneNumber());
        else if (checkPermission("B"))
            dto.setPhoneNumber(entity.getPhoneNumberPartialMasked();
        else
            dto.setPhoneNumber(entity.getPhoneNumberMasked());
        return dto;
    }
}

If you are using the spring framework, then you can see the following classes: org.springframework.core.convert.converter.Converter and org.springframework.core.convert.ConversionService. There are lots of examples out there on how to use these.