This is as much a philosophical as a technical question. We are using EE 2.11.1 for this project.
We have relatively complex front-end permission requirements. They are all need-to-know permissions, i.e. views not edits. I have researched the topic and found the hooblong and hookan add-ons. However, based on my dev experience, I believe I can create a custom system for our permissions requirements. But as I am new to EE, I am not sure if I should. So this is mostly a question of 'best practice' and if you can see issues down the road.
- Super Admins
- Editor Type A
- Editor Type B, etc.
- B2B User
- B2C User
The difference between B2B and B2C user can be nicley solved through EE's internal template permissions. However, the B2B Users will have a very granular and mix-and-match permissions requirement:
- View Country 1
- View country 2, etc.
- Application View 1
- Application View 2, etc.
There are nine countries and the applications list will be extended post-publication. A B2B User can have a very individual combination of these permissions, i.e. it's not feasible to solve this through member groups. (Additionally there will be permissions synchronization from our CRM system.)
Using Solspace's User Add-On, we are implementing a system where a user is always associated (as Associated Author) with a company channel entry. The permissions illustrated above will always be company-wide, i.e. all users associated with a company will have the same permissions.
The solution that I am currently considering is:
- Store permissions as fields in company channel entry
- On member login use member_member_login_single hook to load the user's asociated company profile including permissions (will have to do this anyway, as the company profile holds information which will be needed to connect to 3rd party tools)
- In the template, check permissions in the company profile and display content accordingly. (Often it will be a show / don't show case.)
So, is this a terrible approach? Are there any issues experienced EE devs see on the horizon? Are there preformance issues to be considered? Any other input I need to consider?