storing permissions into multi dimensional array php

Question

OK, I am just trying to get better at making more loosely coupled classes etc in PHP just to improve my skills. I have a local test database on my computer and for the user table I have a column named "role". I am trying to build a function that is a general function for getting permissions for a user so it doesn't depend on a specific task they are trying to do.

When a user tries to do something such as create a new forum topic etc, I want to query the database and if "role" is a certain value, store permissions in a multidimensional array like the following:

$permissions = array(
    'forums' => array("create", "delete", "edit", "lock"),
    'users' => array("edit", "lock")
);

Then I want to be able to search that array for a specific permission without typing the following at the top of every PHP file after a user posts a form by checking isset($var). So if the user is trying to edit a user I want to be able to do something like the following via a class method if possible

if (Class::get_permissions($userID),array($permissionType=>$permission))) {
   // do query
} else {
   // return error message
}

How would be a good way to have a loosely coupled permission checking function that will be able to do something like this? It doesn't have to be laid out exactly like this but just be loosely coupled so it can be reused and not be bound to a certain task. But I want to be able to have an array of permissions instead of just "admin","user", etc for reusability and so it doesn't restrict my options down the road. Because I have a bunch of code that is like this right now in the top of my php script files.

if (Class::get_permissions($userID) == "admin") {
   // allow query
} else {
   // return error
}

Thanks for any input to help me get this to where I don't keep writing the same stuff over and over.

Answer 1

Your question is a little vague, but I will do my best. You said you're storing their permissions in an array $permissions.

public static $permissions = array();

public static function setPermissions($perms)
{
    if (!is_array($perms)) {
        throw new Exception('$perms must be an array.');
    }
    self::$permissions = $perms;
}

public static function hasPermission($section, $action)
{
    if (array_key_exists($section, self::$permissions)
        && in_array($action, self::$permissions[$section])
    ) {
        return true;
    }

    return false;
}

Using that logic, when you read a user's permissions from the DB, then set the Class::$permissions static var like so:

Class::setPermissions($permissions);
// ...
if (Class::hasPermissions($page, $action)) {
    // user has permission
}

Note, my code is pretty generic and will have to remain that way until I have more information. For now, I'm assuming your permissions array is using a page section as the index and the array is a list of actions within that page section that the user has access to. So, assuming $page has been set to something like "forums" and the user is currently trying to perform an edit (so $action = 'edit'), the Class::hasPermission() function would return true.

Answer 2

I ran out of characters in the comments... But this is to your comment.

@corey instead of having a static object, I include a function that sets my permissions in the user's session. It as part of my LoginCommand class that gets called whenever the user logs in, obviously.

The permissions are then stored from view to view and I don't have to keep querying. The permissions check for most things only happen when the user logs in. However, certain sensitive things I'll run another query to double check. This has the disadvantage that, if the user's permissions change while the user has an active session, these changes won't be pushed to the user.

Remember to exercise good session security. PHP Session Security

The only reason you wouldn't store data in your session size is because your session got too big. But unless you sessions are megabyte's, you probably don't need to worry about this.