User rights management (binary rights aggregation)

RobertK · 01-08-2008, 04:44 PM

I'm coding my own project on the sidelines, much like everyone else. But I intend to have a user rights system with a per-user override. Math isn't my strong suit, but especially not the binary sort! I'm halfway decent with it.

Here is the basic structure of the user table and user_class tables; what I want to do is pull the rights of the class, add any overrides, and exclude any rights forbidden.

Code:

  _users
    id       = int64
    ...misc details
    class    = int32
    exc_mask = int64
    inc_mask = int64

  _user_classes
    class_id = int32
    name     = text (max 255)
    rights   = int64

Now, I know I can OR the inclusion mask with the class rights to get the full rights given. But how do I exclude the rights? I know I can do XOR, but that isn't wise. If the permission isn't set, excluding with XOR will grant the right I wish to revoke.

One way may be AND NOT the mask for the exclusions (bits in the exclusion mask that are TRUE will be excluded) but I cannot remember if this is the correct operator.

So as you can see, I'm stuck trying to remember. I'm just writing the specifications right now, and I want to follow up with essential query parts. So I'd like to make note of which operations are significant to this, as well as if they can be done in the SQL query itself. Like (100% pseudocode, don't use this folks!):

Code:

SELECT (rights OR inc_mask AND NOT exc_mask) as 'rights' from myTable where yadda=yadda;

Thanks for the help in advance.

Edit:

I asked my Dad, who knows a great deal of binary things, and he says the process is what I thought. In PHP this would be:

PHP Code:


			
$rights = ($baseRights | $incMask) & ~$excMask;

Can anyone tell me if I can translate this into a MySQL query? I cannot seem to find data for binary functions in selections.

Edit2:

Well, it appears that the operands are exactly the same in MySQL, fortunately! I think I've solved my own question.

I'll write up an article on this subject when I get it implemented.