[geeklog-devel] GL2 ACL

[Tony Bibbs]

Vinny, here is a link to the original model well over a year old:

http://geeklog.tsystemscorp.com/staticpages/index.php?page=20030612212743102

Is the itemACL table the same as you were envisioning it?

--Tony

Tony Bibbs wrote:

> Can you send me the CREATE TABLE syntax with the ACL stuff in it?  As 
> an FYI, I'm modeling everything in the database and generating the 
> schema.xml from it as opposed to the other way around.
>
> I'll work on the rest of the kernel-only datastructures.  We'll want 
> to bring Dwight in soon for a real DBA's perspective and then we can 
> open up that work to the community for fruther scrutiny.
>
> --Tony
>
> Vincent Furia wrote:
>
>> Not sure when I'll have time to spend on IRC (I can't do that from
>> work).  If you just use propel to generate the basic data model for
>> the ACLs I think that would be a good start.  I think either of us
>> could write the xml for that...then its probably just a matter of
>> extending the acl and item classes that propel creates (and
>> potentially the peer classes as well).
>>
>> Extending the classes can come later though.  First things first, and
>> that is getting the xml schema done...  First one to get it done email
>> the other?  I wasn't sure how much you might have coded up already. 
>> We should get the schema.xml for GL2 "core" done soon at any rate I
>> think...
>>
>> Let me know which way you want to play it.  I'm game.  I should have
>> one or two hours every night this week and then a couple over the
>> weekend as well to work on some stuff.
>>
>> The decision on Auth_Enterprise sounds good to me.  Propel can
>> generate some nice simple user and group tables for us to work with.
>>
>> -Vinny
>>
>> P.S. Might it be time for a separate GL2-devel mailing list?
>>
>> On Wed, 15 Dec 2004 11:39:10 -0600, Tony Bibbs <tony at tonybibbs.com> 
>> wrote:
>>  
>>
>>> Vinny, any chance you can I can hash this out ASAP? I've a minimalist
>>> data model created that I'd like to pipe through Propel.  I know a lot
>>> will change but it will at least put the whole security issue to bed.
>>> I've been in IRC hoping to catch up with you but gl-bot keeps 
>>> telling me
>>> you haven't been around in 9 days ;-)
>>>
>>> Also, I'm thinking strongly about not including Auth_Enterprise by
>>> default.  I think GL2 should function alone and allow it to be easily
>>> customized to use any auth system.  Auth_Enterprise is a real work of
>>> art but I think the installation and administration is complex and 
>>> would
>>> only suit large or business oriented sites.
>>>
>>> --Tony
>>>
>>> Tony Bibbs wrote:
>>>
>>>   
>>>
>>>> Vincent Furia wrote:
>>>>
>>>>     
>>>>
>>>>> Actually I don't think performance will be a problem.  All that needs
>>>>> to be done is a single SQL call with a straight join or two DB calls.
>>>>> I suspect that Propel will do the latter.
>>>>>       
>>>>
>>>> We can force Propel to do it the way we ask.  If it natively wants to
>>>> do 2 calls we can use a named query and force a join instead.  There
>>>> may even be a way to do the joins with the Propel models themselves
>>>> but this I haven't tried yet.
>>>>
>>>>     
>>>>
>>>>> Yes, though I still will argue that Geeklog should keep a
>>>>> "permissions" table (story.edit, etc) internally and ACLs should be
>>>>> kept against that as well.  But I bet Tony and I will talk about that
>>>>> later. :)
>>>>>
>>>>>
>>>>>       
>>>>
>>>> Right, the system privileges would go in Auth_Enterprise.  The
>>>> item-level settings would go in the gl-database.  Of course, we will
>>>> combine the data structures of the two so we are really talking about
>>>> the same database.
>>>>
>>>>     
>>>>
>>>>> And so people know where I got most of these ideas: I did a lot of
>>>>> work with the Andrew File System (AFS) in school, and grew to really
>>>>> like the granularity of its permissions system.  Heres a web site 
>>>>> that
>>>>> goes into the basics of that:
>>>>> http://www.psc.edu/general/filesys/afs/setpermissions.html.  
>>>>> Hopefully
>>>>> you'll be able to see what I was shooting for.
>>>>>
>>>>>
>>>>>       
>>>>
>>>> Didn't know that.  I'll have to take a gander.
>>>>
>>>> --Tony
>>>> _______________________________________________
>>>> geeklog-devel mailing list
>>>> geeklog-devel at lists.geeklog.net
>>>> http://lists.geeklog.net/listinfo/geeklog-devel
>>>>     
>>>
>>> _______________________________________________
>>> geeklog-devel mailing list
>>> geeklog-devel at lists.geeklog.net
>>> http://lists.geeklog.net/listinfo/geeklog-devel
>>>
>>>   
>>
>> _______________________________________________
>> geeklog-devel mailing list
>> geeklog-devel at lists.geeklog.net
>> http://lists.geeklog.net/listinfo/geeklog-devel
>>  
>>
>
> _______________________________________________
> geeklog-devel mailing list
> geeklog-devel at lists.geeklog.net
> http://lists.geeklog.net/listinfo/geeklog-devel