title: How to support authorization when roles keep changing based on the information requested?
body: <p>I am badly confused about the authorization process. I am working upon a web app, where we have groups, in which people work together -- hence the information is available to all the people within the group. We also have a feature to 'follow' a group (did I hear twitter?) so that the followers of the group can also access, but only to read, the data of the group (in my case, some 'posts', yes fb-like posts). The problem is authorizing people - in a <b><em>good</em></b> way. Actually, I have got the work going well since I have directly fed the authorization work into the sql queries that I use - by limiting the records in the WHERE clause. But for some reason I find this way bad - very bad. Only if I could add the authorization work in the code, it would feel better. But maybe this approach is good, I don't know! If it is so then tell so, or tell me a better way to do this. And yes, I am creating a RESTful API, if that may help in understanding my problem.
  On the last note, I am just a beginner-intermediate-er  in all this, so please bear with me if you don't feel the problem described properly.
  One more thing, it is not a copy of facebook or twitter or a mix of both.
  Thanks!</p>
  
  <p>Ok. Maybe I should include a code sample of the Data Access Layer. That should make understanding my problem easier. Here's the code which returns a 'project' with a given id. A project is accessible either to project members (listed in project_members table) or to those who are following it (listed in project_followers table).</p>
  
  <pre><code>    public function getProjectById($id) {
          $auth = new Auth();
          $userid = $auth-&gt;getCurrentUserId();
  
  
          $sql = "SELECT P.id, P.userId, P.name, P.description, P.creationTime, P.startTime, P.endTime, P.isOpen FROM projects P INNER JOIN project_members PM ON PM.projectid = P.id AND (P.id = '{id}') AND (PM.userId = '{userid}' OR P.isOpen = 1)";
  
          return $this-&gt;result($sql, array( "userid" =&gt; $userid, "id" =&gt; $id ));
      }
  </code></pre>
  
  <p>Now, for some obscure reason I find the query dirty. Maybe it might be clean, but is it good to handle authorization this way. Or is there any other better way?</p>