Plugin permissions in an IRC Bot

Question

My friend and I are writing an C# IRC Bot that will allow users to extend it's capabilities via plugins. We need it so that each command will be able to have its own permissions. So that only a user on a specific level or above could execute the command. We had a hard time deciding how to do this.

The permissions system would be 1-10. 1 being the least privileged and 10 being the most. Each user would be assigned a 1-10 permission. Each command would also assign itself a required permission level. My question essentially is: How could I make a per-command permission system with plugins being able to have multiple commands within them.

I was hoping the good people of Stack Overflow could help me. Please bear with me as this is the first question I've asked here. Any help will be greatly appreciated! Thanks!

Answer 1

that would definitely work, another way is the concept of 'capabilities'. each user has a list of capabilities such as 'update-user', 'delete-user', 'download-file', etc. the list is unlimited. you can grant users capabilities and each function can check against the required list it needs

if (!checkCaps('shell-cmd', 'google', 'open-url')) sendError('sorry, no perms')

roles can be defined which aggregate a set of permissions, like 'guest', 'user', 'manager', 'admin' etc.

Answer 2

I would create your own implementation of IPrincipal which would return the values of 1-10 for the roles which represent the authorization level the user has. You then assign this as the principal permission when you authenticate your user.

Then, it's a matter of applying the PrincipalPermission attribute on all the methods (meaning your plugin methods, and others) to allow people in the appropriate role to execute the code only.

For example, if I have level five, then I am assigned roles 1, 2, 3, 4, 5.

You can have one method has a PrincpalPermission attribute where the Role property is set to 6, which I would not have access to and another method which has a PrincipalPermission attribute with the Role property set to 3, which I would.