I am planning to use Ext JS for a large application. The application\'s features are role based. When user login, they only see menu and screen features related to them. My
Don't bring functionality to the client that the user is not allowed to see. You can load js files dynamically, but your app server must enforce your rules; no role, no JS.
var jsFile = document.createElement('script');
jsFile.setAttribute( "type", "text/javascript" );
jsFile.setAttribute( "src", 'someFileName.js' );
document.getElementsByTagName("head")[0].appendChild(jsFile);
You can use an LDAP or a simpler server-side solution, but (again) don't serve JS to users who have no right to it. On the client, check for the existence of a class (during development create one class per JS file), and do not attempt to create an object when its class is not loaded.