looking for advice : structure of multi-user/multi-section admin

VisionsOfCody

I'm trying to work out how to structure a multi-user/multi-section admin and it's a bit of a puzzle

Here's the set-up I need :

There are two types of Admin : superadmin and admin - the superadmin has access to all but the normal admins are limited to what they can see - and it's the superadmin who sets the permissions

The site has 5 dynamic sections (this doen't change) and inside each section there are a variable number of subsections that are managed by the superadmin

so, the normal admins can have access to one or several subsections.

At first I thought of just having a page with a vertical list of all subsections with a checkbox for each one and then having a table in the db that stores pairs of admin_id<->subsection_id to state which subsections each admin can access.

The problem with this is when an admin needs to have access to all of the subsections in a section - the superadmin could just click all the checkboxes in that section - this would give the admin access to all existing subsections in that section

but if the superadmin adds a subsection he'd have to manually go through all the admins clicking the checkbox for that subsection

so what i need i some way of having a indicator of partial or total access to each section for each admin - but i really can't figure out how to fit it into the structure

is my only option having another db table that displays partial/total access to each section ? Then if the access is partial it would query the admin_id<->subsection_id table to see which individual subsections they can access ?

any help or pointers on the best and simplest way to structure this would be welcome

thanks

sneakyimp

one way would be the way unix/linux does it.

there is one superuser (root)
you can define arbitrary groups of users
any given object to be shared has an owner and a group
any given object to be shared has a permissions specification for superuser, it's owner group, and it's owner user that independently specifies settings for read/write/execute.

It's a pretty good system: time-tested and flexible for many different situations. If you need to assign permissions for some arbitrary group or users to a particular object, you can just create a new group that contains those users. To make someone an Sports Admin, you merely create a group called Sports Admins, add users to that group, and assign that group to a variety of objects pertaining to sports. Ditto for Arts, Entertainment, and News.

In terms of data structures, you would probably need
a user table (userid, various user info fields)
a group table (groupid, group name)
* a group membership table (userid<->groupid)

for your objects to be shared, you'd need to be able to specify which groups have access. if it's only one group per object, then a single field in your object table. if it might be several users or groups, you'd need another table to assign multiple groups or users to an object.

as for managing all this, you would probably need to give the superuser access to a page to assign users to groups and a page to assign priveleges for any given object. you might need more.

VisionsOfCody

thanks for your very complete reply !

And it's as i suspected, there isn't a quick and nasty way of doing this - I should've thought more about this aspect before launching into it

ah well, you live and learn !

thanks again

sneakyimp

Well there might be. That's just the first one that came to mind.

VisionsOfCody

hehe - fair enough - I'll keep searching