---
# System prepended metadata

title: Permission and Role System
tags: [concept]

---

# Permission and Role System



## Notes

- working title: `indigo`
- multiple roles mapped to one player
- inheritances
- `xxx.yyy.*` wildcard permissions
- `-xxx.yyy.*` negative permissions (also with wildcards)
- numerical group id as identifier (maybe as slug/string? human readable)
- questions
    - for `displayname` etc. we use translations with keys like `group.displayname.{id}`
    - we do not need additional information, just use permissions like `blabla.friends.max.36` for that
- service to get roles and permissions of a player
    - also a route to check a specific permission against a given player. Like asking the service: "does he have permission for xy.zz?"
    - and to modify and update permissions (call event to update cache -> https://github.com/cloudevents/spec)
- data model
    - `id VARCHAR PRIMARY_KEY`
    - `priority INT`
    - `transient BOOLEAN`
    - `color VARCHAR(6)`
    - table for: role definitions, role <=> permissions, role <=> user subaccount, user subaccount <=> permissions
- also part of the project:
    - the paperspigot plugin to inject the permissions into the player i.e. overriding the `hasPermission` check
- role and permission regex:
    - role: `xxx_yyy`
    - permission: `xxx.xxx.*.zzz`, `xxx.yyy`, `xxx.yyy.36.zzz`
- service written in: Go or Kotlin, Go would need a Hagrid Go Client probably (or not, depending on how easy it is to use Kafka with Go)
    - name: `indigo`
    - first: using gRPC to build the routes for GET, UPDATE, DELETE and stuff
- dbmate for sql migrations: https://github.com/amacneil/dbmate

###### tags: `concept`