Brethren, some advice please...
I've written a permissions module which is the ultimate in flexbility in inherited permissions, so for instance:-
- Does user John have edit permissions on Image X?
- John is a member of the group New York call centre, which is a member of group Admins
- Image X's parent is website xyz.com. It is a member of group All Images.
- website xyz.com is a member of group All Websites
- group Admins has edit permissions on group All Websites, so, yes, via inherited permissions, John does have edit permission on image X
You will understand that this is flexible, but slow. It needs to retrieve the permissions for all combinations of John and his parent and groups, and image X and its parent and groups.
So when requesting the inherited permissions for John/X, it finds all combinations and asks for the inherited permissions of each, and caches the result in itself. (Which of course means that every previously checked combination is cached as well.)
This is all well and good, but it raises issues:
- How long do we cache permissions for? Some permissions will change rarely, others frequently.
- Let's say that a high level permission changes, do we find all the permissions that inherit from it and remove them from the cache?
- If we're running this across multiple servers, how do we do it? Do we have a single cache eg MySQL, which at least means that there is only one version of the cache, but (and we're doing many lookups) it is slower than eg Cache::FastMmap - but with FastMmap you have cache inconsistency inbetween machines.
- Or do you perhaps build a system that notifies the other machine of items that need to be uncached?
Wisdom greatly received.