The problem is I suspect (and others seem to agree) that not passing in the user ID to the service is bad design. But how do I get around doing that without sending the user ID via ajax? I can think of a few options, none of which I really like or know of a good way to implement:
1) Add a controller layer on the server side, in which case I can call SecurityService->getUserId() in the controller and pass in a separate call to PostService->findUserPosts($userId); the problem with this approach is that it requires me to add a bunch of controllers that are for the most part pretty redundant. As it is, I already a PostService->findPosts() method that basically just calls PostGateway->findPosts(). I can live with that redundancy because there will be a lot of places where the service will need to do more. But adding a third layer with a controller with a findPosts() method, that seems too much of a pain.
2) Pass the user ID in the ajax request and come up with some kind of tampering mechanism to make sure the ajax request can't be altered. I could do that by hashing the URL string of my request and appending that as a parameter, and then on the server comparing the hash. This is more obfuscation than anything though, since the hash would need to be generated client side, which means somebody looking through the code could figure out how the hash is generated.
3) Keep things as they are, bearing in mind that my user ID is at least not hard coded and various implementations of the Session object could be used, that way the user ID can be retrieved in multiple ways, not tying me to the PHP $_SESSION object.
4) Use a hybrid method of #1 and the current setup where if I need to access session info I use a controller, otherwise I call the service directly. This could work, though it doesn't feel like a clean, unified approach.
I tried to figure this out with two separate questions dealing with separate smaller problems, but I think the lack of context made it difficult to answer, so figured I'd formulate a question with the entire problem. Suggestions are welcome. Suggestions are welcome. Or should I say, much needed!
UPDATE: maybe a valid compromise would be to have a PostService->findByUser($userId) method and then have a UserService->findPosts() method that gets the userId from SecurityService the same way PostService is doing now?