Allow more segments in the permission

[christianberkman]

Hi,

I would like opinions on this idea:

What if permissions could be allowed to have more sescions beyond scope and action. It would be total optional and I believe it would not break any existing installations.

Permission examples:

// Permissons
blog.write.daily-section
blog.write.weekly-section

// Groupes
owner: blog.* // includes all blog permissions
superwriter: blog.write.* // includes blog.write daily and weekly permissions
okaywriter: blog.write.weekly-section 

if it is something that is wanted by others, I can look in to how to get it done. Should not be that impactful?

I believe this could add some conveniecne and prevent needing to add many permissions to a group.

[christianberkman]

I have now implemented this as below by extending the UserEntity and overriding UserEntity::can()

This allows permissions with unlimited more sections after scope.action like blog.edit.monday.mornings

public function can(string ...$permissions): bool
    {
        // Check scope.action style permissions
        $parentCheck = parent::can(...$permissions);
        if ($parentCheck === true) {
            return true;
        }

        // Deep wildcard search (scope.action.more.more...)
        $matrix = setting('AuthGroups.matrix');

        foreach ($permissions as $permission) {
            // Skip if permission only has scope.action
            if (substr_count($permission, '.') === 1) {
                continue;
            }

            $permission = strtolower($permission);

            // Walk down permission tree
            foreach ($this->groupCache as $group) {
                $walker = $permission;

                while (substr_count($walker, '.') >= 1) {
                    $check = $walker . '.*';

                    if (isset($matrix[$group]) && in_array($check, $matrix[$group], true)) {
                        return true;
                    }
                    // Walk down one more step
                    $walker = substr($walker, 0, strrpos($walker, '.'));
                }
            }
        }

        return false;
    }

[kenjis]

This feature seems to be useful when it is implemented securely.

The following is "Security Considerations" by ChatGPT.

Security Considerations:

1. Permission Overlap: Ensure that more granular permissions do not unintentionally override or conflict with broader permissions. For example, if blog.write grants access to write to the entire blog, having blog.write.daily-section should not provide unintended access unless specifically defined.

2. Misconfiguration Risks: With added complexity, there’s a greater risk of misconfiguring permissions, which could either restrict access too much or open it up too broadly.

3. Hierarchical Enforcement: Consider how you’ll enforce these permissions. Will having blog.write.daily-section implicitly grant blog.write, or do you need both? Clearly define how these permissions are inherited or related.

4. Logging and Auditing: As you increase granularity, ensure your logging and auditing mechanisms are robust enough to track the use of specific permissions effectively.