Elgg is designing a permissions API loosely around the Activity Streams model. The user API could look (roughly) like:
function elgg_can($capability, $subject = null, $object = null, $target = null) { ... }
$capability
is a string$subject
is a user object$object
is the object acted upon$target
is the context in which the action would take place
E.g. Can the current user edit the title of an object?
if (elgg_can('edit title', $currentUser, $someObject)) {
...
}
I'd like to know a good way to handle asking for permission to create objects. If the object doesn't yet exist, then the permissions system can't know anything about it, so there's a chicken-egg problem with a few obvious solutions:
- Allow passing in a string in place of $object (e.g. the TypeName).
- Put metadata about the object in the $capability. E.g.
elgg_can("create PageObject", $currentUser, null, $group)
. - Have the API user create the object then pass it into the API to decide if it should be allowed to continue existing.
Am I missing another obvious solution? Are there permissions models similar to this (that one could reasonably call successful) that handle this?