Re: My Scenario

Hi There,
I've done some reading and here's what i have come up
with....
Thanks to Lukas and Jan for helping...


VIEW Rule - is meant to be for the purposes of viewing
an Area
ADD Rule - is for Adding more content to that Area
EDIT Rule - is for Editing the current added
content....
DELETE Rule - is for deleting.... 

NOTE how sometimes DELETE Rule is not present it's
because just can not do that, 
ex: can i delete the Job Summary? There must be
something there, otherwise the job does not exist.


Let's say that's what i need to completely finish my
User Permission system.
THE OWNER or Top SuperUser who can do everything would
get everything that the system has(every right).

SuperUser #1 = All SuperUser + All HR + All Candidate
SuperUser #2 to N = Parts of SuperUser + Parts of HR +
Parts of Candidate....

HR = Parts of HR Area and Parts of Candidate (Or All
Of HR and Candidate)

Candidate = Own profile

If the EDIT right is Assigned then the View Right will
always apply everywhere.

You might be asking WHY am i giving a Candidate Rights
when they are all ways going
to have all of the Permissions, well, the answer is
that i might want an HR or SuperUser
to have restricted access to the Candidate Profiles.

Since the jobs depend on the Companies then if the
right of a company is set to VIEW only
then the rest of the HR section is going to get the
VIEW Right

Maybe i should sort the Rights by their action, view
being the first and so on.
Here's why: if i wanted to change something i would
only check for the permission
that is grater than 3 (3 being the Edit Right), this
includes the "ALL RIGHTS" if someone
had all of the rights...

I know i know there's something already in LU for the
preview 2 lines i wrote but
i still did not grasp the concept yet.

Comments are welcomed.....


This will be my parts of php code....

$app_id =
$objRightsAdminPerm->addApplication('SOMEAPP', 'SOME
APP Applications');
// 1 HR Sample Area
$area_id1 = $objRightsAdminPerm->addArea($app_id,
'AREA_HR_REQ', 'Job Requirements');
// 1 SU Sample Area
$area_id2 = $objRightsAdminPerm->addArea($app_id,
'AREA_SU_PERMS', 'User Permission Management');

// Then he adds three rights
$right_1 = $objRightsAdminPerm->addright($area_id1,
'VIEW',   'View Page');
$right_2 = $objRightsAdminPerm->addright($area_id1,
'ADD',  'Add Content to Page');
$right_3 = $objRightsAdminPerm->addright($area_id1,
'EDIT',  'Edit page's Content');
$right_4 = $objRightsAdminPerm->addright($area_id1,
'DELETE',  'Remove Content From Page');
//repeats for other areas



// Grant the user rights
$objRightsAdminPerm->grantUserRight($user_auth_id,
$right_1);
$objRightsAdminPerm->grantUserRight($user_auth_id,
$right_2);


And for each Area first i would check for the View
Right, then if they change anything i'd
check for the EDIT/DELETE/ADD rights

$LU->checkRight(VIEW); //first part



----SuperUSER-----
AREA_SU_USERS 
	-ADD
	-EDIT
	-VIEW (search)
	-DELETE

AREA_SU_PERMS 
	- ADD
	- EDIT
	- VIEW
	- DELETE

and so on....



----HR------------
AREA_HR_COMPANY - VIEW
	- EDIT
AREA_HR_JOBSUMMARY 
	- EDIT
	- VIEW

AREA_HR_JOBAPPLICANTS 
	- EDIT
	- VIEW

AREA_HR_REQ - ADD
	- EDIT
	- DELETE
	- VIEW  

and so on....


----CANDIDATE-----
AREA_CAND_PROFILE 
	- EDIT
	- VIEW

AREA_CAND_EXPERIENCE 
	- EDIT
	- VIEW
	- ADD
	- DELETE

AREA_CAND_XYZ 
	- EDIT
	- VIEW
	- ADD
	- DELETE
and so on....
--- Lukas Kahwe Smith <[email protected]> wrote:

> Afrim S. wrote:
> 
> > My prolem here is that i do not have any
> documentation or sample applications on how i would
> make a most advanced permission system with
> LU(something like, "Demonstrate the scope of LU"). I
> just need a sample of the HR and SuperUser of how i
> would add the users/permissions/groups. 
> 
> The most advanced use of LiveUser that is freely
> available is likely the 
> WebBuilder application framefork:
>
http://oss.backendmedia.com/index.php?area=WebBuilder2
> 
> However even there its left up to the developer how
> to structure his rights.
> 
> > Would i also be able to add these permissions to
> each right: add job, delete job, view job within the
> ManageJob right.
> 
> This is starting to sound more like you want to
> create an area for each 
> "right" .. note at this point we should stop using
> the term "right" the 
> way you are doing to avoid confusion.
> 
> I dont know if you have read my LiveUser article 
>
(http://phpmag.net/itr/online_artikel/psecom,id,595,nodeid,114.html).
> 
> But there is a section where I talk about RBAC. This
> standard uses the 
> terms users, roles, permissions, objects, and
> operations.
> 
> It sounds like what you call "right" is an object
> onto which you can 
> grant a certain set of operations. The way to do
> this in LiveUser as the 
> article explains is to dynamically create an "area"
> for each object and 
> then create a right per operation.
> 
> Also note that there is a cool feature called "area
> admin" that would 
> allow you to grant all rights for an area to a
> single area in a single 
> go. Furthermore there is a superadmin permission
> type that automatically 
> grants the given user all rights in the system. For
> an area admin you 
> need to set the perm_type in the perm_users table to
> 3 and insert the 
> necessary relations into the area_admin_areas table 
>
(http://pear.php.net/package/LiveUser_Admin/docs/0.3.4/LiveUser_Admin/LiveUser_Admin_Perm_Complex.html#methodaddAreaAdmin).
> 
> A superadmin is defined by a perm_type of 4 or more.
> 
> regards,
> Lukas
> 
> 
> _______________________________________________
> LiveUser mailing list
> [email protected]
> http://mailman.21st-hq.de/mailman/listinfo/liveuser
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com