Implementing Permission Systems
1. Defining Permission Schema
| Convention | Example |
|---|---|
| resource:action | orders:read, orders:write |
| domain.action.resource | billing.view.invoice |
| CRUDS | create, read, update, delete, share |
| Conditional | orders:delete:own |
2. Creating Permission Checks
Example: Centralized check helper
public class PermissionChecker {
public boolean can(User user, String permission, Object resource) {
if (user.hasPermission(permission)) return true;
if (permission.endsWith(":own") && isOwner(user, resource)) return true;
return false;
}
}3. Implementing Resource-Based Permissions
| Pattern | Detail |
|---|---|
| Owner check | resource.owner_id == user.id |
| Tenant scope | resource.tenant_id == user.tenant_id |
| Shared resource | ACL lookup |
| Row-level security | DB-enforced (Postgres RLS) |
4. Using Permission Wildcards
| Pattern | Matches |
|---|---|
orders:* | All actions on orders |
*:read | Read on any resource |
* | Superuser (use sparingly) |
| Hierarchical | billing.* matches billing.view.invoice |
5. Implementing Permission Inheritance
| Direction | Detail |
|---|---|
| Role hierarchy | Parent role inherits child's perms |
| Resource tree | Folder grant → file inheritance |
| Group nesting | Group A in Group B → A's members get B's perms |
6. Combining Multiple Permissions
| Operator | Use |
|---|---|
| Any (OR) | Has any of [a, b, c] |
| All (AND) | Has all of [a, b, c] |
| Not (NOT) | Does not have x |
| Conditional | has(x) AND env.mfa == true |
7. Implementing Conditional Permissions
Example: Time-bound permission
function canAccess(user, resource, env) {
const grant = user.permissions.find(p => p.action === "approve");
if (!grant) return false;
if (grant.condition?.business_hours && !isBusinessHours(env.time)) return false;
if (grant.condition?.max_amount && resource.amount > grant.condition.max_amount) return false;
return true;
}8. Caching Permission Checks
| Layer | TTL |
|---|---|
| Request-scoped | Memoize within single request |
| User session | 30 sec–5 min |
| Distributed | Redis with invalidation events |
| Invalidate on | Role/permission change, user disable |
9. Implementing Permission Delegation
| Aspect | Detail |
|---|---|
| Grant | User A delegates subset of perms to user B |
| Constraint | Cannot delegate more than self has |
| Time-bound | Auto-expire (vacation coverage) |
| Audit | Log delegator + delegatee + actions |
| Revocable | By delegator or admin |
10. Auditing Permission Changes
| Event | Logged |
|---|---|
| grant | actor, subject, permission, resource, timestamp |
| revoke | actor, subject, permission, reason |
| role create/update | diff of permissions |
| policy change | before/after rule |