Basic deal is, we have a custom built "kickstart" for our projects. For this we are looking at redoing the user control. I know there are a lot of questions out there about general rbac, but I cannot find any on hierarchical rbac?

Our requirements are:

  • Roles can be assigned to group permissions
  • If the role does not have a permission entry then it is automatically denied
  • A user can be given overriding permissions
  • A users overriding permissions is either a grant or deny
  • If a user is explicitly denied a permission no matter what roles say "granted" the override wins.
  • Users can have multiple roles
  • Roles can have hierarchy
  • Roles can inherit from other roles (e.g. A "Forum Super Moderator" role is a "Forum Moderator", and a "System Maintainer", and the "Forum Moderator" role already inherits from the "Forum User" role )
  • Roles that inherit from another role that deny or grant a privilege override their child permission
  • Permissions are grouped by "module" (e.g. a "Blog" module can have an "edit entry" permission, and a "Forum" module can have an "edit entry" permission and they will not clash)
  • There is a "Everything and Anything" permission that automatically grants full access

So, with those requirements out of the way, here's how I am thinking of doing it.

Table: Users

id            | int     | unique id

Table: Roles

id            | int     | unique id
--------------|---------------------------------------------
title         | varchar | human readable name

Table: Permissions

id            | int     | unique id
--------------|---------------------------------------------
module        | varchar | module name
--------------|---------------------------------------------
title         | varchar | human readable name
--------------|-------------------
php mysql permissions hierarchy rbac
Edit
Report