为权限设置数据库表的最佳方法

Question

I'm wondering the best way and how many tables to use for handling permissions for my application.

I want to give a user access to either:

• a single project
• all projects for a certain client
• all projects

I have a table already for projects, a table for users and a table for clients.

Would you create 3 new permissions tables eg "Permission_Project", "Permission_Client" and "Permission_All" or a combined table?

Thank you

Answer 1

It will be better to create a table with your users first. For example, table with the following columns:

UserID
Login
FirstName
LastName
...

Then to create a table with security groups, with the following columns:

SecurityGroupID SecurityGroupName SecurityGroupDescription ...

Then, in your permission tables, you can store for example, which projects and clients are visible by each security group. For example:

ProjectID SecurityGroupID
100       10001
100       10002
...

meaning that project ID 100 is visible by groups 10001 and 10002 and

ClientID SecrutiyGroupID
1001     10001
...

meaning that client with ID 1001 is visible by group 10001 . And the last table you need is for users - security group associations:

UserID SecurityGroupID

So, you need to create two interfaces:

• to manage users membership in security groups
• to manage project and clients visibility to security groups

And for easier work with the tables, generally a function is created with input parameter user id, which outputs the visible clients/projects by the given user.

Also, consider adding a access type in your permission table - for example, view or deny . So, you can make a use a member of group which is seeing all clients for particular project, and at the same time make a user member of group that is denying the access to particular client in the same project.

It is more easy to grant access to project containing 30 clients, and then deny the access for one of the clients, then granting access to 29 clients. Also, it is more convenient to work with groups of users, then with many users. For example, in your application you may have code like this:

If member of group 'show all clients' then render this HTML

which is better then:

if used id in (101,102,103,104...) render this HTML

It is easier, right?

Plan, well before codding this. Once the application code is increased and the system starts working,it may become very difficult to change how you are handling security and permissions.