StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POORM: authorization via reachability
primarykey
Id
11833364
data
AcceptedAnswerId
0
AnswerCount
1
ClosedDate
CommentCount
0
CommunityOwnedDate
CreationDate
2012-08-06T17:52:46.547
FavoriteCount
1
LastActivityDate
2012-08-06T20:03:25.163
LastEditDate
LastEditorUserId
0
OwnerUserId
1257349
ParentId
0
PostTypeId
1
Score
2
ViewCount
78
LastEditorDisplayName
text
Body
We are building a webapplication which uses a database. Also we use an object relational mapper to access the database. One aspect of authorization in the webapplication is that the user may access an object referred to by an URL. The URL contains a unique id (for example the Primary Key) to a specific record in the database. Consider the following example. <ul> <li>a user may belong to many groups and a group may have many users (many-to-many).</li> <li>a survey belongs to a group (many-to-one).</li> <li>a survey may have multiple questions. (many-to-one).</li> </ul> Say we have the following URL: <a href="http://app.local/question/edit/10" rel="nofollow">http://app.local/question/edit/10</a>. This means we want to edit question with PK 10. Now, we want to verify if the logged in user may access question with PK 10. This can be done by retrieving this question, then it's survey then it's group and then all its users. If any of the users is the same as the logged in user the logged in user may access the question. To generalize this a bit; we want to check if a record is reachable from another record by the known many-to-one or many-to-many relations. So if there is a many-to-one relation (like with a survey and a question then we should check if a user is reachable from the question through the survey and then through the group. The group has a many-to-many relation with the user so we should check if any (not all) of the users is the same as the logged in user. If a table has multiple many-to-one relations, say; we can attach a CSS template to a survey and this template also belongs to a group then we have to check if a user is reachable from all many-to-one relations (thus the group and the template). The same holds of course for multiple many-to-many relations. Are there Object Relation Mappers which support this behaviour? And what is this behaviour called, maybe reachability? Does Propel (for PHP) support this behaviour? I think this reachability can be done in any of the following two ways: <ul> <li>Execute a query to get each "parent", uses many queries)</li> <li>Join all necessary tables to see if a record exists (the reachable users matches the logged in user) in one query.</li> </ul> Furthermore this behaviour of the ORM should support nested sets, thus if a group contains nested set behaviour it should also try to reach a user through the group's parent. I don't think this kind of behaviour should be restricted to authorization; objects should simply be able to see if they can reach another object. Note that I do not mean persistence by reachability: <a href="http://jpaobjects.sourceforge.net/m2-site/main/documentation/docbkx/html/user-guide/ch08s03.html" rel="nofollow">http://jpaobjects.sourceforge.net/m2-site/main/documentation/docbkx/html/user-guide/ch08s03.html</a>. Or... am I simply looking at this authorization wrong and is there a far better and different approach with an ORM?
Tags
<orm><authorization>
Title
ORM: authorization via reachability
singulars
PostAcceptedAnswerId
1. This table or related slice is empty.
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. This table or related slice is empty.
UserOwnerUserId
1. USmeijuh
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 POORM: authorization via reachability
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
2. VO
 singulars
 PostPostId
 POORM: authorization via reachability
 UserUserId
 USGrampa
 VoteTypeVoteTypeId
 VTFavorite
3. VO
 singulars
 PostPostId
 POORM: authorization via reachability
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId
1. This table or related slice is empty.

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.