How to structure a MongoDB database to allow for multiple users to use the same account with restrictions based on roles? Ok, firstly I'm very new to MongoDB, and newish to DB development/management as a whole. I've done a unit using Oracle through uni, but apart from just manipulating fields through the phpmyadmin interface for wordpress plugins/sites, that's about it.

I want to model a (fairly complex?) user system. Here's an excerpt from the brief relating to it.

Users should be able to log in with their email and password, create a new account, invite other users and set different access rights. This way multiple users can share the same account with different levels of authority (ready-only, editing rights, etc.)

The backend needs a section where the business owner can set global restrictions on areas/sections of the app for different groups of users.

I've done a bit of research into structuring a MongoDB database and understand there should be a balance between embedding data into documents, and referencing other documents so that in the end you require fewer queries than if you embedded everything or referenced everything.

Here are my initial thoughts.

Side note - I don't know how to properly document a MongoDB schema so sorry if this doesn't actually make sense. I'll try explain it as best I can.



The diamond connections are for embedded objects inside documents, while the straight connections show references. (i.e AccountUsers are embedded in an Account while a Role is referenced by a User and AccountUser). I should probably update this to show directions and relation. Anyway...

I believe this setup allows both Users on an application level, and users on an account level to have separate roles that can be retrieved later. Global restrictions could be set by the business owner for all users of a certain role, and the admin of an account can set account wide restrictions based on setting a user's account role.

The roles themselves are arrays of objects containing a boolean and a reference to a SitePermission. The idea being that the SitePermissions will be setup by the dev team, with one SitePermission for each section of the app, from which the business owner or account owners can create their own roles.

Does this setup seem like a good way to go about creating a database that suits the brief? Like I said, I'm really new to MongoDB so I could have this whole thing completely wrong by treating it similarly to an RDBMS like Oracle. I basically just need to know if I'm doing this right? Thanks!
When working on an authorization requirement for any application, there are three essential elements that are part of the setup: 

•   The resources that need to be secured/authorized
•   A list of roles and users that are part of these roles
•   A mapping between the resources and the roles that define who can access what