Cfloginuser - roles of object permission. Array?

Question

Hello, wonderfully helpful people!
Imagine a project that involves a corporate structure. Some
users can only see themselves, some users can see one (or many)
departments, and maybe an extra user or two. Some users can see
everything. Etc.
Now, expand this to include many corporations, each with
their unique corporate structures, and a single person has access
over (seemingly) arbitrary objects within multiple corporations.
Basically, the user's permission is at the object level;
there's not a *role*. And, to add a little extra fun, I do not know
all the objects involved - it's dynamic -, and those objects do not
have a unique id amongst themselves.
What I would like to put into roles is a list of lists; a
list of each object type, containing the ids for that object that
the user has access to. Perhaps the first value is the object type,
and the rest are the ids. Example:
{1,12,13},{2,12,52},{3,12,42}
I'm currently doing a workaround to make the list like, in
order to be able to use the IsUserInRole and whatnot (though it's a
bit tedious):
1_12,1_13,2_12,2_52,3_12,3_42
So:
1. has anyone else dealt with object-level permissions using
cflogin? How did you do it?
2. what suggestions might you make to improve this?
Thank you in advance! Surely there's a better way to do this.
Best wishes,
Cat

Answer 1

Sorry no good tutorials, I've mostly figured it out by trial
and error.
I find that security schemes tend to be very personally and
vary
wildly from application and organization to another.
The basic concept is a CFC that stores the relevant
information and the
appropriate functions to retrieve this information in the
desired
format. A big question is do you want this cfc to be aware of
the user
information store(s) or to have that factored out into
another layer.
For easy of readability I'll provide the basic skeleton of a
CFC that is
not aware of the data store but the roles are passed in. I
have also
built this such that by just passing in a user ID the
component
generates all the user data.
<cfcomponent name="User Object">
<cfscript>
variables.name = "";
variables.roles = structNew();
</cfscript>
<cffunction name="init" ...>
<cfargument name="name"...>
<cfargument roles="" ...>
<cfscript>
variables.name = arguments.name;
variables.roles = arguments.roles;
</cfscript>
</cffunction>
<cffunction name="getName"...>
<cfreturn variables.name>
</cffunction>
<cffunction name="getRoles"...>
<cfreturn variables.Roles>
</cffunction>
<cffunction name="isUserInRole"...>
<cfargument name="role"...>
<cfreturn
structKeyExists(variables.roles,arguments.role)>
</cffunction>
</cfcomponent>
This is extremely bare bones and will need considerable
fleshed out but
it should give you an idea.
Then you just replace the <cfloginuser.... line with a
createObject()
function or <cfinvoke...> tag to call this CFC init
function passing in
the required arguments. And call thisObj.isUserInRole where
you are
calling isUserInRole().