3 ms·
This is not a programming problem, this is a Roles design problem. Admin is not a role, its a type of user. You might call it a container if you want... but r
by swalsh 11y ago
This is not a programming problem, this is a Roles design problem. Admin is not a role, its a type of user. You might call it a container if you want... but roles are more fine grained, and should be a hierarchy.
You can put a hierarchy of Roles in a database, but the actual role check can (and I think should) be hard-coded.
In your API you might have a method "public void NewProduct()" That individual method should have the ProductWrite permission (role), and you can give that permission to higher level "containers" or "roles". So Admin has ProductWrite, and ContentManager might also have ProductWrite. In your code it's just one check has("ProductWrite").
Does that make sense?
- evtothedev 11y agoInsisting on it being a hierarchy is an easy way to get into trouble. Eventually, you'll want to give someone "just one more permission" It's more flexible to have a composition of roles, such as "UserCreator + FinanceReportRunner" or something like that.
- Shorel 11y agoI think you are confusing roles with permissions. Admin is a role, can_delete_everything is a permission. Users are assigned a role. A role can have one or many permissions. Program code checks for specific permissions. Example: username => swalsh, role => hn_subscriptor, permission => can_post, permission => can_upvote.