Question

If I have data which I only want to assign to users who have an admin role, how would I represent this in the db schema? i.e. I have a users table, roles table, user_roles table and this particular user is linked to an admin role. How would I then be able to specify information only for admin users?

Answer 1

EDIT4: So if I understand, you have the users table, role table and an association linking users to roles.

One idea would be to put the value in the role table, then basically you’ll have multiple role for multiple admin levels.

Or you can create other fields in the association table, to parametrize the association, but that would impact all other association. (or ou can have : X is in group B with option1=1, option2=42, option3=NULL and treat options fields differently depending on the group)

Other idea, but I would have made it completely differently:

you treat groups as users, with a special field call isGroup [True/False]. Then you create the groupAssociation table which stores which user belongs to which group.

Example :

USER
--Id--    --IsGroup--
A         False
B         False
C         True
D         True

GROUPASSOCIATION
--uid--   --BelongsTo--
A          C
B          D
C          D

Note that you can cascade saying that C is included in D.
Then you create a privilege table and associate groups or user to certain privileges.

PRIVILEGE
--Id--    --Name--
1         Access Area 1
2         Access Area 2
3         Modify user
4         Edit on StackOverflow

PRIVILEGEASSOCIATION
--uid--   --pid--
A         4
C         2
D         1
C         3

So user A would have all privileges (one direct, two from C group, one for D group since C is included in D) and B would have only one (from group D)

Would it be better in your case?

---

EDIT3: Given your last comment, this in not valid anymore
The GRANT command will help you sort out your problem.

You can see it right there : GRANT

As an example :

GRANT SELECT ON db2.invoice TO 'jeffrey'@'localhost';

You can do it for a column only, for all table, or all database as well

EDIT: Oh well, let me check for groups. I forgot that part.

EDIT2: I didn’t see anything about group permission tuning in MySQL : this said it’s not possible but it’s quite old. But I came accros this other SO question and they are using PHP to manage the groups.