So I'm making a bug tracker to help me learn Ruby on Rails. My current setup is something like this:
has_many :permissions, through: :metadata. Also some other stuff, but that's all that's relevant to this question.
Metadatum(bad name, I know, but it'll work for now)
has_many :permissions, and
belongs_to :metadatum, and both
has_one :project, through: :metadatumand
has_one :person, through: :metadatum. It represents one person being able to do one thing on one project -- for example, add a new bug, or assign someone to a bug, etc. etc.
Now, my question is if this is a good way to go about adding different levels of permission that are different for each project -- so, for example, Project Manager Eve can't edit Project Manager Bob's projects just because she's a PM too, and QA James can't add lots of bugs to a project he isn't supposed to be testing.
It makes sense to me because each project has metadata that applies to everyone (which is stored in
Project) and individual metadata for each person (which is in
Metadatum and includes stuff like if they've starred it or if they've assigned it a custom name). To me, it's sensible that
Metadatum would also store the permission level, since that's dependent on the project and person both.
However, I'm concerned about space usage, though I don't know if I should be. It would be fairly trivial to change it to use some bitmasking magic to do the same thing, but my concern about that is that it's less readable, and only allows a certain amount of permissions to be added before running out of room in a number. I'm also concerned that it'll take longer to check if someone is allowed to do something than bitmasking, because instead of
permission & 1<<12 you have to check
project.permissions.find_by(person: person, allows: :allowance), which involves filtering twice, and isn't as readable. However, it's conceptually simpler to understand, and custom methods could easily be written to simplify the syntax.
Have I got the best approach? How can I do it better?