{"time":1692018263411,"blocks":[{"id":"vx5kouaBYz","type":"header","data":{"text":"The Problem","level":2}},{"id":"GwEHvQE8hq","type":"paragraph","data":{"text":"While working on a role feature on the content management system/admin section (not released yet) of this blog application, I wanted to make some roles where admins would be able to edit any posts, delete posts as well as a few more privileges."}},{"id":"xwaG_LBGXo","type":"paragraph","data":{"text":"Initially, I gave everyone a default `Member` role and have an express route where you can become an `Admin`by entering a pre-defined private key and submitting. This would trigger a role change for the currently authenticated user and grant them those defined privileges"}},{"id":"5U8wjYmiTI","type":"paragraph","data":{"text":"This worked fine to a good extent until I wanted to make a super admin role which would be able to make admins from their own end. They would also exhibit all the same rights as the admins i.e. edit, and delete posts. This would mean I would create a new role `Super Admin` and apply to myself as the creator of the application. It was at this point I remembered the way roles are handled on Discord. "}},{"id":"rHZGhc2MQ5","type":"header","data":{"text":"Discord's Solution","level":2}},{"id":"lWp4wMkdDs","type":"paragraph","data":{"text":"On Discord, after joining a server, everyone has a default role (which would be `Member` in my case). Then the creator of the channel could assign new roles and these new roles would compound to the member role rather than replacing it."}},{"id":"JAqVVSkRGe","type":"paragraph","data":{"text":"So initially there would only be two roles `Creator` and `Member`. Now rather than replacing the `Member` role with an `Admin` role, you could create an `Editor` and `Deleter`. These two new roles would then be added to the already `Member` role. Now you would just keep creating and adding roles removing them when you want to"}},{"id":"j8IFGVgnyj","type":"paragraph","data":{"text":"A member could have an Editor role but not a Deleter. This member would be able to edit messages of people but not delete them. Another member could be able to share links on the platform with a role `LinkSharer` but not be able to Edit or Delete messages of other people. You can also easily make the Editors or Deleters share links by adding `LinkSharer` to their roles"}},{"id":"zA8EyzJGMz","type":"paragraph","data":{"text":"This brings me back to why I like the idea of `Composition` than that of `Inheritance`. The former tends to be more flexible and scale easier. Going into the topic would be for another blog post but if you're interested, Check out this Wikipedia article on Composition vs Inheritance"}},{"id":"bgpLP-PPcK","type":"header","data":{"text":"Conclusion","level":2}},{"id":"-d5AXaG0SA","type":"paragraph","data":{"text":"Building applications in future, whenever I need to have any sort of authorization system using roles, I would always consider using this composition method by creating roles based on the activities the user would perform rather than based on who the user is."}},{"id":"nxZrSHSPM4","type":"paragraph","data":{"text":"I'm sure with more experience, I would find a situation where the other method would suit better. As the classic answer to all vs programming question is always `It depends`."}}],"version":"2.27.2"}

Comments (0)

No Comments Added Yet