New Permissions Model

[Resolution]

Ok I know what you're thinking.. Not again! Just hear me out is all I ask, I think I'm onto somthing here.

For the past few years I have been secretly developing an experimental CMS / FORUM / ENGINE thing.. y.. You get the idea. Well, I'm done with development and I no longer wish to persue it for commercial gains so I decided to donate the modules to open source. Here's where it concerns you guys.

One of the modules I've developed was a permissions module. This permissions module has things I've never seen anyone else pull off.

• 1. Full Role Based - WITH groups and associations all defined via DATABASE
  
  2. Built in workflow - with infinite tree modeling - (ie, you can make it as big or small, complex or simple as you like)
  
  3. Pluggable triggers - This is from the CMS but it's usable everywhere. This means you can WRITE PHP code for a permission trigger. So it's not ONLY dependent of database group / access level associations.
  
  4. EXTREMLY fast! Because it's all cached and in lookup tables. Which means 1 look up (depending on if it has a trigger/workflow or not) takes about .00015 seconds on a Celeron 900 mhz!! Which means you can use permissions EVERYWHERE
  
  5. It's flexable. Every aspect of the permissions is logiclly broken down into quantifiable groups/areas. IE, its easy to understand piece by piece respectivly.
  
  6. Will REQUIRE sessions.. I have a sessions as well. If needed as a test bed or for whatever.

...Well that's just the tip of the iceburg. It will need some reworking because I used a totally different model (internal) than PHPBB but the basiclly it's the same in essence.



I hope I can get a chance to contribute for the good of everyone AND so such excellent code doesn;t go to waste because I have no more use for it. I've since switched majors to biology.

cheers

[Resolution]

Oh yea. If anyone has any questions as to what the module/s can and or can not do, please feel free to ask.


cheers

[bas]

And where can i download your code?

I just want to compare with the files from phpbb...

[Resolution]

I'm currently at work, so I'll have to post them after I get home.

As for comparing the two I'm not sure how you're going to do that!

The code convention is completely different, it all needs to be converted out of Class structure (base classes included). But once it's converted to PHPBB permission checking takes place on 1 LINE! That includes transversing the permissions tree, searching, ect. 1 line of code. That also includes standard workflow searches. 1 LINE OF CODE.

I can post the code so you can smile and wonder though.

If you have any questions feel free to ask em'.



cheers

[psoTFX]

We cache permissions per user, we cache permission results on the fly, we allow unlimited permission options and include an API method to add additional options, you can use permissions anywhere, we allow user and usergroup permissions with deny/inherit/allow, it takes (allowing for necessary existence of data checks) two lines to check for global and local permissions, everything is stored in the DB in a state that can, if absolutely necessary, be manipulated manually. We have a sessions system that has been proven on thousands of installs of phpBB 2.0.x, a system that has already been updated to increase functionality without increasing load.

Thus, at this fairly late stage of development I see no obvious reason to change our system as it stands.

[Resolution]

Awesome, thanks for the reply PSO!

I'll have to download you guys current code, I admit I haven't seen ti in SOME TIME. I suspect it's sexier than last time I saw. As for all the things you stated, check, check and check. I'll look to see if the IS anything that I may be able to contribute even if it's just and idea.

Thanks for the feedback.

cheers

[Resolution]

I'm browsing through the CVS now. Could someone direct me to the permissions files?

Thanks in advance,
Cheers

[metest12]

The auth class in includes/sessions.php

[Roberdin]

Awesome, thanks for the reply PSO!

I'll have to download you guys current code, I admit I haven't seen ti in SOME TIME. I suspect it's sexier than last time I saw. As for all the things you stated, check, check and check. I'll look to see if the IS anything that I may be able to contribute even if it's just and idea.

Thanks for the feedback.

cheers

Several days later, while browsing through e-bay, I notice...

Life for auction. Barely used, mint condition. Still in shrink wrapping. Excellent buy for geek or nerd. Being sold on because I have a new permissions module. Bidding starts at £15. NO RESERVE.

Just Kidding. Don't take it personally.
Are your permission classes available anyway? I wouldn't mind taking a look.

[Resolution]

Firstly, thanks for the response metest. I found it!

Before i began I would just like to applaud the PHPBB team for such a fine job on the code. I'm impressed, because the last time i saw the code was in January! It's matured nicely in feature and ease of use. I think you guys might be the reason VB keeps postponing that new release... {mums the word}

I have had a change to completly evaluate the PHPBB permissions system DB and code and I have to say it runs tight! PSO, saw your name in the CVS, kudos!

I think after installing PHPBB and field testing it, that it handles what it needs to. The permissions model is a custom fit, using foriegn keys (aliases) to directly link to the permission keys, for user and groups (roles). with an additional permission definition key table for an additional level of indirection that allows growth in the permissions area.Btw what's the difference between local and global? Global as in GLOBALS?

The code seems to be a tight mix of call DB -> parse -> save as global or sessions key. This is where I had a thumbs up, the code is nice and tight here, well done.

To compare and contrast, I'll just outline the differences - you can inquire later on if you like.

• Has a full b-tree structure for the skeleton and permisions. So permissions can be dependent on thier ancestors.
  • Example: 1. {permissions} No write access without read access.
    
    2. {skeleton} Even if you have access to an entire module if a root denies access you cannot execute those permissions. -- Think of a house where the entry doors are locked but all the other doors inside thehouse are open. If you cant get in you cant DO anything in the house.
  Triggers - get around the problem of being GENERAL. It allows a permission to call an external piece of php code which HELPS it validate access.
  
  Permissions are set via User, and Role (like PHPBB) but also has associations. Associations allow individuals to create clans or clicks in which they can share information by sharing permissions.
  • Think of starting a Star Trek group where you guys have your own forum, calendar, ect.. Roles TRUMP Associations, and personal permissions TRUMP both.
  Indirect permission assignment. Insted of using foriegn keys modules are assigned access to permissions via AREAS. Areas identify modules, so they know where to find all thier access data.
  • I have a whole naming convention that goes with this so it works logicaly
  Inheritable skeleton permissions and action permissions.
  
  Permissions are prefixed and suffixed. So I can mix and match predefined actions with custom actions. like so. EDIT_post, EDIT_calendar, READ_post, READ_profile.. ect.. The capitals are the prefix, the rest is the suffix.
  
  
  Then there is the workflow which has no real place in a forum so i wont really get into that unless someone is interested.
  
  
  Last, EVERYTHING is kept in class structures - except the jump files, but that's for another day.

Well that's about as general as I can get without straining anyone's eyeballs form such a long read! 8O



Well, from my opinion PHPBB has all she needs to really function. If you guys see any ideas youd like to discuss for fun or project let me know. I guess I'm just going to release all my stuff GPL with no one to marry it to. Oh well, what's a papa to do?


Cheers