DOC: Describe gotchas when using Hibernate server-side

[jamoore]

While trying to help create a custom search bridge with specialized annotation logic, a known hibernate issue arose:

See:

• ​https://forum.hibernate.org/viewtopic.php?p=2371113
• ​https://forum.hibernate.org/viewtopic.php?t=947035
• ​http://opensource.atlassian.com/projects/hibernate/browse/HHH-3502
• ​http://stackoverflow.com/questions/3787716/introspection-table-name-of-an-object-managed-by-hibernate-javassistlazyinitia
• #1794
• #1183 ([c522cd54cb7843b1f9a2dc2b33ff2079128f4e5/ome.git])

Workaround:

public static <T> T getProxiedObject(T proxy){
        if ( proxy instanceof HibernateProxy ) {
           return (T) ( ( HibernateProxy ) proxy ).getHibernateLazyInitializer().getImplementation();
        }
        return proxy;
    }

...
annotationObj = getProxiedObject(annotationObj);

Seen elsewhere in our code (BasicSecuritySystem.java):

    public <T extends IObject> T doAction(SecureAction action, T... objs) {
       Assert.notNull(objs);
       Assert.notEmpty(objs);
       Assert.notNull(action);

       final LocalQuery query = (LocalQuery) sf.getQueryService();
       final List<GraphHolder> ghs = new ArrayList<GraphHolder>();

       for (T obj : objs) {

           // TODO inject
           if (obj.getId() != null && !query.contains(obj)) {
               throw new SecurityViolation("Services are not allowed to call "
                       + "doAction() on non-Session-managed entities.");
           }

           // ticket:1794 - use of IQuery.get along with doAction() creates
           // two objects (outer proxy and inner target) and only the outer
           // proxy has its graph holder modified without this block, leading
           // to security violations on flush since no token is present.
           if (obj instanceof HibernateProxy) {
               HibernateProxy hp = (HibernateProxy) obj;
               IObject obj2 = (IObject) hp.getHibernateLazyInitializer().getImplementation();
               ghs.add(obj2.getGraphHolder());
           }
...

[jmoore]

See also #5768

[jmoore]

Pushing. We actually want to encourage people to not do this in later versions, so might be better to hold off.