Re^2: User access controlled by subroutine attribute.

Thanks for replying.

It's funny, I was listening to your talk on PDX.pm that got me thinking about Attribute::Handler. And I agree that your access control to objects works but I'm having this nagging feeling that using it for user access will have weird problems for users. Like a user getting so far into a program before they get an access denied. That may not be a bad thing. I'm just not sure.

rlb3

Comment on Re^2: User access controlled by subroutine attribute.

Replies are listed 'Best First'.
Re^3: User access controlled by subroutine attribute. by ikegami (Patriarch) on Aug 14, 2006 at 21:45 UTC
You could check permissions up front, and check it again at the function level as a failsafe. That way, your users won't normally get "far into a program" before getting an error.	[reply]
Re^4: User access controlled by subroutine attribute. by rlb3 (Deacon) on Aug 14, 2006 at 21:49 UTC
That is true but then there is no point of making access attached to each sub with an attribute. rlb3	[reply]
Re^5: User access controlled by subroutine attribute. by gellyfish (Monsignor) on Aug 15, 2006 at 08:06 UTC
I see it as protection from developer error. You probably want to have authorization handled in a way that allows you to both restrict the overt choices that a user can make and also to give the user a more friendly message up front, which all probably requires explicit coding nearer the front end. However if there is the possibility of an unintended method getting called (a typo in a dispatch table or an unchecked action parameter for instance,) then you might feel it is appropriate to prevent that method being called by unauthorized users. Call it a belt and braces approach. /J\	[reply]
Re^6: User access controlled by subroutine attribute. by rlb3 (Deacon) on Aug 15, 2006 at 14:50 UTC