User Access Control and Data Visibility

Question

I have a Access Control based on Roles and Permissions, meaning That each group has permissions to access Some Controllers and users are part of those groups. (this is implemented in CakePHP framework)

But this structure allows me to know what user is authorized to "use" like, access reports or add new users, but I was wondering what are best design patterns, or best practices that I could use to implement data visibility is some of those groups. For example, the group "Ordinary User" member's can only see their own data (data.user_id = this.user_id) but member of "Supervisors" should see more data (data.user_id = this.supervisor_user_id) and the "The Boss" members should see everything.

I hope I made myself clear, anyway the authentication model I am using is based on this model:

http://www.studiocanaria.com/articles/cakephp_auth_component_users_groups_permissions_revisited

Answer 1

Just add your permissions to a before_find(). You could do it on a model-by-model basis, or build it into the app_model. This will allow you to limit data or add/remove fields while not having to modify the controller or view files.