title: Is my Role Based Access Control a feasible solution?
body: <p>I'm designing a very simple RBAC (Role Based Access Control) system in my PHP project and after giving it some thought I've came up with a solution, but without knowing much about building business systems I'm not sure if there are, or would be, any major design flaws with my solution.</p>
  
  <p>So basically, I want to give a user a set of 'roles'. I will use these roles to allow or deny access to certain functionality on the application.</p>
  
  <p>Here is the roles table:</p>
  
  <pre><code># Roles
      - id [auto-increment, unsigned]
      - role [string, length:50]
  
  # User_Roles
      - user_id [FK:user_id, unsigned]
      - role_id [FK:roles_id, unsigned]
  
  Note: user_id and role_id to be unique index
  </code></pre>
  
  <p>The problem that concerned me was there was no information in the database about what the role actually does. But then I started to think if that was important. Because if the roles had meaningful names, and a structure, then you could query the <code>user_roles</code> table to get all the users roles and then within code something like:</p>
  
  <pre><code># Fetch user with ID 1 from database
  $user = User::find(1);
  
  # Fetch the roles the user has from the database
  # @returns : Array of roles
  $userRoles = $user-&gt;roles()
  
  # $userRoles = ['newmember', 'member.post', 'member.chat']
  
  # Can the user send a message?
  if(in_array('member.message', $userRoles)
  {
      # User can send a message
  }
  else
  {
      # User can not send a message
  }
  </code></pre>
  
  <p>The roles can be managed, and can have whatever meaning they like within the organisation. I'm just concerned that the roles in the database have no meaning, I can't help but think there's probably a better way to achieve this.</p>
  
  <p>Would my solution be feasible long term?</p>
  
  <p>Thanks</p>