I'm building a booking system and my team is currently constructing a web application for the system where a staff member should be able to manage all the bookings related to a user with permission to access it. The booking data is pre-existing and used by other applications (no current permission related data exists in the booking data). We've implemented a combined RBAC/ABAC type system.

The schema for a booking looks something like this:

    _id: ObjectID,
    title: String,
    resource: ObjectID,
    etc etc

Would it make sense to instead of adding fields to the current schema objects to instead "abstract" the permissions in a separate collection for the web application something similar to this where a relation is created to the booking object instead?

    _id: ObjectID,
    booking: ObjectID,
    userPermissions: [...],
    roles: [...]

Let me know in-case you need me to elaborate/provide more detail!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.