title: how to do content based authorization?
body: <p><strong>Summary</strong></p>
  
  <hr>
  
  <p>I have some complex database structure and I want to provide the data only to authorized members - the roles of whom also depend upon the data stored inside the database. It was working till now, but now that I want to expand the services, it is getting really complex. There has to be an elegant way.</p>
  
  <p><em>Note</em>: I am not using ASP.NET, so please don't suggest those remedies which are tightly bound to it, although I am open to ideas about modelling the authorization process.</p>
  
  <p><strong>Background</strong></p>
  
  <hr>
  
  <p>Alright, I had asked this question before too, but to my surprise, it didn't reap any good responses as such, so here I am posting it again in different words. I am working on a web app and have problem in how to model authorization process in an elegant way.</p>
  
  <p>Let's say I have an app which provides the following services. There are 'projects'/workspaces where you can post something and also comment on those posts. The projects, which are deemed as 'open' can also be 'followed' - and hence the content is accessible to the followers. To bring this situation closer to my actual service, the project 'members' can decide what the followers have access to. This might (or might not!) look complex, but the actual app is more complex. What I did was to fill in the filtering code inside the sql queries themselves. Here's a code sample:</p>
  
  <pre><code>    public function getProjectById($id) {
          $auth = new Auth();
          $userid = $auth-&gt;getCurrentUserId();
  
  
          $sql = "
            SELECT P.id, P.userId, P.name, P.description,
                   P.creationTime, P.startTime, P.endTime, P.isOpen
            FROM       projects P
            INNER JOIN project_members PM
                        ON PM.projectid = P.id
                       AND P.id = '{id}'
                       AND (PM.userId = '{userid}' OR P.isOpen = 1)
          ";
  
          return $this-&gt;result($sql, array( "userid" =&gt; $userid, "id" =&gt; $id ));
      }
  </code></pre>
  
  <p>This looks bad, since I also have to provide this data to project followers (not shown here). And the complexity rises in the comments and posts - handling code. Now, is there a better way to do this - there must be. Should I separate out the authorization logic to other classes? Or/And should I use 'Views' in the database (completely unnecessary, but still i'd like to point out that they are not the MVC views)? Or is there still a better, clumsy-free way to solve this problem?</p>
  
  <p>All suggestions are welcome - even those that aim at changing the database structure - although I wonder why that'd be required.</p>
  
  <p>Thanks in advance!</p>