{"action":"created","issue":{"url":"https://api.github.com/repos/OWASP/rbac/issues/60","labels_url":"https://api.github.com/repos/OWASP/rbac/issues/60/labels{/name}","comments_url":"https://api.github.com/repos/OWASP/rbac/issues/60/comments","events_url":"https://api.github.com/repos/OWASP/rbac/issues/60/events","html_url":"https://github.com/OWASP/rbac/issues/60","id":56944824,"number":60,"title":"[Improvement] Permissions contextualization","user":{"login":"Kern046","id":6918102,"avatar_url":"https://avatars.githubusercontent.com/u/6918102?v=3","gravatar_id":"","url":"https://api.github.com/users/Kern046","html_url":"https://github.com/Kern046","followers_url":"https://api.github.com/users/Kern046/followers","following_url":"https://api.github.com/users/Kern046/following{/other_user}","gists_url":"https://api.github.com/users/Kern046/gists{/gist_id}","starred_url":"https://api.github.com/users/Kern046/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kern046/subscriptions","organizations_url":"https://api.github.com/users/Kern046/orgs","repos_url":"https://api.github.com/users/Kern046/repos","events_url":"https://api.github.com/users/Kern046/events{/privacy}","received_events_url":"https://api.github.com/users/Kern046/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-02-08T09:03:12Z","updated_at":"2015-02-08T19:33:12Z","closed_at":null,"body":"Hello people !\r\n\r\nThis issue is a kind of proposal about the permissions.\r\n\r\nCurrently, we are using two hierarchical trees : one for the roles, the other for the permissions.\r\n\r\nIt allows applications to have a better manipulation of the users rights, but I think it is not enough.\r\n\r\nFor example : I have the permission \"read_article\". If I want to set a group of articles private, I have to operate other controls to check if I can read the article. It is sad that RBAC alone cannot check it itself.\r\n\r\nWhat I'm proposing : On another project, we put, above RBAC, some models and services to set the notion of context. Imagine that Article is an object. When we check the \"read_article\" permission, a new table allows us to know on which object the permission is granted (Project\\Model\\Article for example), and the IDs for which the permission is available.\r\n\r\nI think it would be better if RBAC let the possibility to add such level of control on the permissions. That's why I create this issue, to be a base of discussion on eventual pull requests.\r\n\r\nI'm not sure if my english was proper enough to make you understand the idea, don't hesitate to ask questions if this was not clear !"},"comment":{"url":"https://api.github.com/repos/OWASP/rbac/issues/comments/73427151","html_url":"https://github.com/OWASP/rbac/issues/60#issuecomment-73427151","issue_url":"https://api.github.com/repos/OWASP/rbac/issues/60","id":73427151,"user":{"login":"Kern046","id":6918102,"avatar_url":"https://avatars.githubusercontent.com/u/6918102?v=3","gravatar_id":"","url":"https://api.github.com/users/Kern046","html_url":"https://github.com/Kern046","followers_url":"https://api.github.com/users/Kern046/followers","following_url":"https://api.github.com/users/Kern046/following{/other_user}","gists_url":"https://api.github.com/users/Kern046/gists{/gist_id}","starred_url":"https://api.github.com/users/Kern046/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kern046/subscriptions","organizations_url":"https://api.github.com/users/Kern046/orgs","repos_url":"https://api.github.com/users/Kern046/repos","events_url":"https://api.github.com/users/Kern046/events{/privacy}","received_events_url":"https://api.github.com/users/Kern046/received_events","type":"User","site_admin":false},"created_at":"2015-02-08T19:33:12Z","updated_at":"2015-02-08T19:33:12Z","body":"Ok, thank you for your time and for your answers :) !"}}