Flexible system of rights for the site

Question

PHP

Habravchane,

For the project, I need to make a system for restricting access to content in style very similar to VKontakte. Those. each "post" (let's call it that for simplicity) should have view settings: Visible only to friends; Visible to all; Seen registered; Visible to the following groups (custom selection of groups that the user created for himself from his contacts).

I seriously thought about how to implement a similar thing, so that when I pull out “posts” from MySQL right in the same query, I can apply a filter and pull out only those “posts” that are available to the user. If it weren’t for custom groups, then I thought in the direction of markers like:
Visible to everyone - 0
Visible to registered users - 1
Visible to friends - 2
Well, accordingly, for the current user, precalculate:
Registered? +1 to the indicator.
And then, at the SQL query level, determine friendship with the owner of the post, and if a friend, then add another +1 to the indicator.
And then apply a filter like WHERE post.access_level <= calculated_access_level

But how to deal with custom groups in this situation is not clear. At the level of instincts, there is a feeling that it is necessary to somehow tie into bit masks, but it is not confirmed by anything. Google didn't help much.

For me, the key is the maximum simplicity and speed of selecting "posts" in accordance with the established access level.

Any ideas?

Answer 1

I did not have to solve such a problem, so I can not imagine other approaches yet. I would go somewhere in this direction:
Table:
post_id, access_level, access_value
access_level - these are your "friends only", "everyone", etc. This also includes the item "listed groups" (field type - enum for readability)
For access_level = 'listed groups', the access_value values ​​\u200b\u200bare filled, respectively, by group id per line. The filter “only to such and such users” will also fit well here.
Accordingly, we select visible posts:
select post_id from posts_access where (access_level = 'groups' and 'access_value' in (groups of this user)) or access_level='all' - and further conditions

Answer 2

php.russofile.ru/ru/translate/rights/phpgacl/ here is written about ACL in a very popular language