PHP Permissions Question

[blyxx86]

Good Morning Everyone,

I am developing a fairly complicated (to me) system that has numerous people logging into it. It manages Inventory/RMA requests for numerous different companies. There is also a central helpdesk that will have access to all of the companies, but I want the individual company employees to have access to their records.

I have developed a permissions array that will be loaded into the session variable. I am wondering if this will work, or if anyone here might have a better solution?

First Key - (grants permission to access that module) (rma/inv/adm/etc)
Second Key - Module above will be filtered by customers in this array
Third Key - Specific tasks that user has access to view
Fourth Key - Create/Read/Update/Delete

Here is the print_r of a sample array.

Array
(
    [rma] => Array
        (
            [customer1] => Array
                (
                    [view1] => Array
                        (
                            [c] => 1
                            [r] => 1
                            [u] => 0
                            [d] => 0
                        )

                    [view2] => Array
                        (
                            [c] => 1
                            [r] => 1
                            [u] => 0
                            [d] => 0
                        )

                )

            [customer2] => Array
                (
                    [view1] => Array
                        (
                            [c] => 1
                            [r] => 1
                            [u] => 0
                            [d] => 0
                        )

                    [view2] => Array
                        (
                            [c] => 1
                            [r] => 1
                            [u] => 0
                            [d] => 0
                        )

                )

        )

    [inv] => Array
        (
            [customer2] => Array
                (
                    [view1] => Array
                        (
                            [c] => 1
                            [r] => 1
                            [u] => 0
                            [d] => 0
                        )

                    [view2] => Array
                        (
                            [c] => 1
                            [r] => 1
                            [u] => 0
                            [d] => 0
                        )

                )

        )

)

Are there problems with doing a permissions array this way? I will be updating the array occasionally when important tasks are being ran (like deleting) to make sure the user still has access to perform that action.

Please provide feedback, opinions, critiques, etc.. I love learning.

[ak1dnar]

I'm not quite happy about these kind of hard coded user permission arrays.

I always prefer to setup database tables for permission mappings. the best way (may be its best only for me) to do this is, setup user groups and setup group permission codes in a table. example:

groups
101 admins
102 managers

permissions
101 C_USER
101 R_USER
101 U_USER
101 D_USER
102 R_USER

so in this example, user group 101 (admin) has the privileges for create, read, update and delete user details. the manager group (102) has only the read user details permissions.

in this way i can assign my system users to specific user group. Once the user logged in to the system we can get user's group and assigned permissions to a array salt. its very easy to manage with a database.

[blyxx86]

I apologise for not making it clear in the first post that the array shown us actually coming from a database I only setup a static array to test out the options.