User, Roles and Permissions

[krballard94]

I'm currently using Laravel 5 and I'm making a open source game engine for people to develop further upon (not a complete game without further development) however I'm looking at a few ideas for user roles and permission based access. I'm completely impartial to several ideas and I would like to ask you would think about doing it.

For example I want a user to have a particular role, but if that user doesn't have access to a permission because of the role, I want to be able to give that user the permission while still not changing his role.

Currently I'm looking at having a users, roles, permissions, role_user (pivot table), permission_role (pivot table) and permission_user (pivot table).

I'm also looking into the idea of having a meta field in the users table and encoding it in JSON.

Any tips would be appreciated.

Edited April 16, 2015 by krballard94
Correcting table name

[G7470]

As seeing something similar to this kind of setup in a more corporate setting, a couple of things to consider (besides having two pivot tables with the same titles (permission_role)):

 

1. Overriding roles - That is really what you're essentially doing when granting a user a particular permission in order to "override" their current role set. My advice: if you're going to setup a permission-role-user system, then stick to that. Allowing to assign permissions to a user as well as assigning roles to a user will get confusing very quickly on a larger scale. You will have a hard time keeping track of who can do what (believe me, I know).
   
2. Pivot Tables - Oh, the joys of pivot tables. My questions to you on that affect are these: why pivot tables? What purpose is that serving you? If you have a DB that is handling user data, why not just create a few normal tables that assign these roles to the user appropriately?
   

 

As someone who has had to handle system security on a much larger scale than a game, those are merely my thoughts.

~G7470

[krballard94]

As seeing something similar to this kind of setup in a more corporate setting, a couple of things to consider (besides having two pivot tables with the same titles (permission_role)):

 

1. Overriding roles - That is really what you're essentially doing when granting a user a particular permission in order to "override" their current role set. My advice: if you're going to setup a permission-role-user system, then stick to that. Allowing to assign permissions to a user as well as assigning roles to a user will get confusing very quickly on a larger scale. You will have a hard time keeping track of who can do what (believe me, I know).
   
2. Pivot Tables - Oh, the joys of pivot tables. My questions to you on that affect are these: why pivot tables? What purpose is that serving you? If you have a DB that is handling user data, why not just create a few normal tables that assign these roles to the user appropriately?
   

 

As someone who has had to handle system security on a much larger scale than a game, those are merely my thoughts.

~G7470

I updated my post, I meant to write permission_user for the second pivot table.

As for the pivot tables, as I mentioned I am working with Laravel which is using Eloquent and these allow me to access them the easier.

http://laravel.com/docs/5.0/eloquent#working-with-pivot-tables