I'm building a ToDo list while practicing in different patterns and adding more complexity to the project.

The problem which I'm currently facing is to how to apply (and later use, validate and enforce) different permissions for different classes of users (PM, Dev, Admin) and for different users of the same class.

I built the following structure and planning to check permissions inside ToDoBoard/SimpleCategory etc by passing a specific user to it. However I'm not sure that it is the right way of doing this. enter image description here

  • This is not my first generation of this topic. If you notice that this post does not follow the policies of this site or anything related - please share the right place where I can get a second pair of eyes on the questions like my. In the end, I think my question is general enough to be useful to others.
    – Roman
    Jan 18 at 23:53

1 Answer 1


I would suggest to follow a more general approach using role based access control (RBAC). I will not go into general here (you can easily look it up).

Using this you would attach the user to a role (not directely to the permission set). The advantage is that a user can have different roles (what makes the whole system more secure).

If you define a permission as a thing that grants the right for a role to perform an operation on an asset you can easily create sets of permissions - and even deal with the operations on permissions ;-)

Hope that gives you some ideas (what does not mean that your approach does not work).

  • Thank you! I was thinking in this direction as well. However I had some mismatch with idea of how to validate permissions etc. I'll review RBAC and get back to you in case of any further questions! PS. I'm looking into the right approach and best practices. I don't want to reinvent the wheel. However to start with something I used common sense. My goal is to learn basics in OOP design and diff patterns at the moment.
    – Roman
    Jan 19 at 1:21
  • @Roman: one of the basics is OOP: do not use inheritance for things which can change at run time, and for things which are not disjoint categories. A user might change their role over time, or have two or three roles at once. So that is where you should change your model. I also disagree to this answer in one aspect, the idea that your current approach could work. I think it does not, and one should not pretend this for just tyring to be polite.
    – Doc Brown
    Jan 21 at 11:05
  • @DocBrown sure thing thank you for your point! I refactored a bit my diagram to implement RBAC in my interpretation. Please take a look and let me know if you see any issues with this: drive.google.com/file/d/1bYIAjgdKMvFlv7-azz-BGi-qCefPdmYK/…
    – Roman
    Jan 22 at 13:10
  • I've implemented observer to make sure that when you update permissions on the role all users which are using this permission receive updated and only after that realized that you don't need to use an observer if you're sharing and updating the same permission instance (facepalm)
    – Roman
    Jan 26 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.