title: Where and how to store User Permissions?
body: <p>Let's say my system is made up of two business object types: <em>projects</em> and <em>users</em>.</p>
  
  <p>According to user permission, s/he can:</p>
  
  <pre><code>| Action          | Role             |
  |-----------------|------------------|
  | view projects   | Clients          |
  | edit projects   | Devs             |
  | manage projects | Managers         |
  | manage users    | Administrators   |
  </code></pre>
  
  <p>The problem is, clients can see only some specific projects. Projects can either be set as public (everyone sees them) or they can be set to be visible to certain specific clients.</p>
  
  <p>Same with devs, a developer can be able to edit his own, as well as other projects as set by a manager. A manager should be able to create and manage users/projects unless an admin specifically denies that capability to the manager for specific projects.
  Admins have full access to manage anything on the system, including all users and all projects.</p>
  
  <hr>
  
  <p>That's pretty muchwhat I'm trying to achieve. "How" is what is worrying me.</p>
  
  <p>Usually, for the roles you would have a 'role' column in your user table, which would specify the kind of role the user has. Since we won't have clients that are developers at the same time, this column  won't need to be a bitmask.</p>
  
  <p>The next step would be to have a rule system to specify what users can access according to their role. It's impossible to fit this in existing tables (without array fields - which are kinda dirty), so I guess I will need a separate table.</p>
  
  <p>This would look like:</p>
  
  <pre><code>| user_id | access  | object_type | object_id |
  |---------|---------|-------------|-----------|
  | 45      | allowed | user        | 42        | user 45 can manage user 42
  | 42      | denied  | project     | 30        | user 42 cannot do anything with
                                                  project 30
  </code></pre>
  
  <p>The table must be used with the user roles. For example, if user 45 is a <em>client</em>, he cannot do anything to user 42 (even if the rule exists anyway).</p>
  
  <hr>
  
  <p>On the other hand, I know I'm aiming at too much flexibility on this one, but I refuse to accept there isn't a way to achieve this kind of functionality.</p>
  
  <p>So, the actual questions:</p>
  
  <ul>
  <li><strong>Is this a good idea?</strong></li>
  <li><strong>Is there a better system?</strong></li>
  <li><strong>Any other suggestions?</strong></li>
  </ul>