SQL Server：存储分层ACL数据

Question

I would like implement a database containing hierarchical acl data

My tables

• USERS : idUser,username,...
• GROUPS : idGroups,name...
• GROUPSENTITIES : idGroup, idChild, childType (1 for users, 2 from groups)
• ROLES : idRole,name...

• ROLESENTITIES : idRole, IsDeny, idChild, childType (1 for users, 2 from groups)

• Every user can belong to 0 or more groups

• Every group can belong to 0 or more groups
• Every user and every group can belong to 0 or more roles and roles can be allowed or denied
• If an explicit deny is found, role is denied

How can I store this kind of data? Is my design correct?

Is it possible retrieve a list of users with all allowed roles?

Can you please write me a query (T-SQL based) for extract this information from db

thanks in advance

Answer 1

You can write the tables as you would expect. For instance, to get all the users in a group, when there are hierarchical groups, you would use a recursive CTE. Assume the group table is set up as:

create table groups (
    groupid int,
    member_userId int,
    member_groupid int,
    check (member_userId is NULL or member_groupid is null)
);

with usergroups as (
      select groupid, member_userid, 1 as level
      from groups
      union all
      select g.groupid, users.member_userid, 1+level
      from users u join
           groups g
           on u.member_groupid = g.groupid
    )
select *
from usergroups;