Hi, I'm looking for some advice on architecture for a client/server solution with some peculiarities.

The client is a fairly thick one, leaving the server mostly to peristence, concurrency and infrastructure concerns. The server contains a number of entities which contain both sensitive and public information. Think for example that the entities are persons, assume that social security number and name are sensitive and age is publicly viewable.

When starting the client, the user is presented with a number of entities, not disclosing any sensitive information. At any time the user can choose to log in and authenticate against the server, given the authentication is successful the user is granted access to the sensitive information.

The client is hosting a domain model and I was thinking of implementing this as some kind of "lazy loading", making the first request instantiating the entities and later refreshing them with sensitive data. The entity getters would throw exceptions on sensitive information when they've not been disclosed, f.e.:

class PersonImpl : PersonEntity
{
    private bool undisclosed;

    public override string SocialSecurityNumber {
        get {
            if (undisclosed)
                throw new UndisclosedDataException();

            return base.SocialSecurityNumber;
        }
    }
}

Another more friendly approach could be to have a value object indicating that the value is undisclosed.

get {
    if (undisclosed)
        return undisclosedValue;

    return base.SocialSecurityNumber;
}

Some concerns:

• What if the user logs in and then out, the sensitive data has been loaded but must be disclosed once again.
• One could argue that this type of functionality belongs within the domain and not some infrastructural implementation(i.e. repository implementations).
• As always when dealing with a larger number of properties there's a risk that this type of functionality clutters the code

Any insights or discussion is appreciated!