Hey you guys, I am following this thread closely. Have some of the same permissions needs as you reference. I am big on NOT reinventing the wheel.
Has anyone thought about turning something like https://phpgacl.sourceforge.net/ into a plugin?
Copied from their website:
——————————————————————————————————————
Summary:
A PHP class offering Web developers a simple, yet immensely powerful “drop in” permission system to their current Web based applications.
Features:
Split into two classes, and a seperate administration interface.
GACL class:? Designed to be very small (517 lines of code including comments) and very fast, this class strictly takes care of the permission checks.
GACL_API class:? Designed to be robust and flexible, this class takes care of creating/editing/deleting objects, groups and ACLs.
phpGACL Administration Interface: A set of scripts that allow for the easy administration of the entire GACL universe using only your browser.
NOT limited to typical “read/write/execute” permissions similar to some flavours of *nix
User definable “Access Control Objects” (ACO). These are objects which control what access is available to “requesters” (see below).
Several examples:
Enable – Projects
View – Projects, View Own – Projects
Edit – Projects, Edit Own – Projects
Delete – Projects, Delete Own – Projects, UnDelete – Projects, UnDelete Own – Projects
Add – Projects
System down for Maintenance
View – The letter “e” ??
User definable “Access Request Objects” (ARO). These are objects which request access from an “Access Control Object” (above) examples would be:
Users/Accounts
IP Addresses
Browsers/Browser capabilities (JS/Flash/DHTML)
User definable “Access eXtension Objects” (AXO). These are objects which extend permissions to a 3rd layer, optionally allowing you to set fine grained permissions on each individual item in your application, or even row in your database. AXO’s are often used in cases where you only want to give a user access to a specific project or contact.
Several examples:
Projects – Project ID: 3474 (Accounting Software)
Projects – Project ID: 3484 (Financial Software)
Contacts – Contact ID: 4775 John Doe
Contacts – Contact ID: 4795 John Doe
Tree based ARO/AXO Object grouping with inheritance.
Example:
Root
|- Staff ( ALLOW [View Own – Projects], ALLOW [Add – Projects], ALLOW [Edit Own – Projects] )
| |- Facilitators ( DENY [Add – Projects] )
| |- Managers ( ALLOW [Edit – Projects] )
| ‘- Executives ( ALLOW [Edit – Projects], ALLOW [Delete – Projects] )
‘- Customers
|- VIP
|- Regular
‘- Annoying ( DENY [ALL] )
In the above example (assume DENY ALL by default) because of inheritance, we gave the Staff group permission to several ACO’s, now any child group has access to those same permissions plus any additional ones assigned. So even though the entire Staff group and all its children groups have permission to “Add – Projects”, Facilitators are denied that right. Only Managers and Executives however are granted permission to “Edit – Projects” and only Executives are granted permission to “Delete – Projects”.
Contains functionality to easily program add-ons. Examples would be for product pricing, or quantity limitations.
Example:
Root
‘- Customers
|- Bronze Package ( Add – Projects [Limit 5, Price $10/each] )
| ‘- John Doe ( Exception to group: Add – Projects [Limit 8, Price $9/each] )
|- Silver Package ( Add – Projects [Limit 10, Price $5/each] )
‘- Gold Package ( Add – Projects [Limit 20, Price $2/each] )
In the above example, we set group “defaults” for each of the three packages, however the real world usually doesn’t work that way,
Customers always make outlandish demands, so let’s satisfy them, John Doe wanted more then 5 projects, but not quite 10, so we simply put in an exception for just him, and gave him a slight discount on the price to keep yet another satisfied customer!
One function application integration: acl_check()
Simply pass this function four parameters, it doesn’t get any easier!
Supports the most popular databases using the ADODB database abstraction layer. (MySQL, PostgreSQL, Oracle, MSSQL)
Complete web based administration interface.
Scalable. A real-world working version with many added layers of complexity supports over 60,000 Accounts, 200 Groups and 300 ACO’s.
——————————————————————————————————————
You guys let me know if this is too complicated for this project. If not, it would seem this would be a good place to start in giving WordPress a robust permissions module (plugin?). I would be willing to find some dev time to do this if it makes good sense.
~ Vertical Cashew