[geeklog-devel] For my friend, Vinny

[Vincent Furia]

Like in GL 1.4.x, you'd have to resolve the total set of group membership
before doing the query.  Since you're caching credentials anyway, you could
cache the total group membership as well.  So, in your example, a user in
group 3 would have a total group membership of 3, B, 2, 1, A.  The the query
would check for rights for all those groups, and "and" the results together
(getting the highest level of access granted to those groups).

There a couple of levels where we can cache this data.  It probably makes
sense to keep it denormalized in the user table or the group table and
update all users when a group memberships are modified.  It can also be
cached in the session, but then you run the risk of updating groups
membership not being recognized until the session expires.

Let me know if additional/better explanation is needed.  I'm not sure I did
all that good a job of describing what I meant.

-Vinny

On Thu, May 29, 2008 at 2:57 PM, Tony Bibbs <tony at tonybibbs.com> wrote:

> Lol, so we are getting serious for the GL2 alpha and the ACL stuff is
> mostly done minus one real PITA.  For reference there's been this page:
>
> http://wiki.geeklog.net/wiki/index.php/Using_ACLsG2
>
> So we've done some incarnation of everything there minus the last section
> called:
>
> "Selecting Multiple Items Based on Permissions"
>
> Any chance you have the "how" part of that?  My brain is hurting.  Why:
>
> Groups can be tied in a complex web (not necessarily hierarchical).  For
> example
>
> Group B belongs to Group A
> Group C belongs to Group B
> Group 2 belongs to Group 1
> Group 3 belongs to Group 2
> Group 3 belongs to Group B
>
> That's a worst case scenario but me-thinks it'd be awful hard to do in SQL.
>
> --Tony
>
>
> _______________________________________________
> geeklog-devel mailing list
> geeklog-devel at lists.geeklog.net
> http://eight.pairlist.net/mailman/listinfo/geeklog-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist8.pair.net/pipermail/geeklog-devel/attachments/20080529/8dc82426/attachment.html>