I'm working on a user management "pseudoframework" in PHP, and I'm trying to implement fine-grained rule-based authorization. I'm using a combination of SQL and condition-checking functions written in PHP right now, but I'm not completely satisfied. It works, but it is not very elegant and suffers from some limitations.
Prolog is Turing-complete, so it occurs to me that any arbitrary authorization rules could be implemented this way. For example:
in_group("Alice","admin"). in_group("Alice","user"). in_group("Bob","user"). in_group("Carlos","admin"). in_group("Carlos","user"). allowed("delete_user",X,Y):- in_group(X,"admin"), not(in_group(Y,"admin")).
This basically says "Only allow user X to delete user Y if X is an admin and Y isn't."
My questions are basically:
- Will issues in scalability still arise in modern Prolog implementations?
- How would these issues be complicated by the way that people typically use web applications?
- What are the risks of compromising security due to the "unintended consequences" of some Prolog constructs?
- How difficult will this make it for people without a Prolog background to modify authorization rules? The above example looks straightforward to me, but what if there are thousands of rules?
If Prolog isn't the best idea for this situation, are there other logic programming languages that might be better suited?
I read this post: Why Aren't Rule Engines Written In Prolog?, but that question seems to be about rules engines in general, not authorization rules specifically.