php - Best practices for website permissions system -
current project working on web application, has delivered multiple customers on own servers. website needs permission control system, manage areas , features users can or can not use.
know, i'm designing database-driven permissions system, permissions stored in database. every user has role. role defines list permissions available. schema looks this:
users table
1. user_id
2. name
3. role_id
roles table
1. role_id
2. name
permissions table
1. permission_id
2. name
roles_permissions table:
1. role_id
2. permission_id
in code fetch logged users role , permissions, , check if user able perform action or see area so:
if($user->haspermission('edit hr')) { // let user see editing hr section } the haspermission check if user has permission name 'edit hr' , return needed result. problem see database table has have permission record name being 'edit hr', not 'edit_hr' or 'hr editing'. have make sure data permissions system same every database applications using. kind of makes me think flawed design , needs re-designed. creating new sections , features require update databases, makes me sad panda.
so, basically, question is: best way design database driven permission system , keep database integrity on multiple databases?
the scheme you've come looks fine. thing add on permissions table add field called tag or similar.
the permission tag edit_hr, , use reference in code instead of name. use name display purposes example hr editing. way name can vary required, , won't affect code.
Comments
Post a Comment