The document describes ProcessMaker 4.0's permission storage and management features. It outlines the naming convention for permissions, how permissions are stored sparsely in a MySQL database, and examples of granting, revoking, and validating permissions for a user. It also provides performance test results for looking up random permissions for a user, showing lookups of 3 permissions take 4-6ms and 100 permissions take 10-12ms. Next steps proposed include supporting multiple permission dimensions, implementing PDO, adding unit tests, and improving documentation.

1. ProcessMaker 4.0
Permission Storage
Oleg Khimich

2. Permission
Name convention:
case.plugin.signature.can_create
^-- entity name --^
^--- permission name ---^
Example:
$this->registerPermissions('case', [
'case.can_create',
'case.can_edit',
'case.can_delete'
]);

3. Storage
Sparse matrix in MySQL
permission_list permission_matrix

4. Granting Permissions
var_dump($this->wipePermissionsForUser($user_id));
// bool(true)
var_dump($this->setPermissionsForUser($user_id, [
'case.can_create',
'case.can_edit',
'nonexistent'
]));
/* ["case.can_create"]=>
bool(true)
["case.can_edit"]=>
bool(true)
["nonexistent"]=>
NULL
*/

5. Granting Permissions
var_dump($this->setPermissionsForUser($user_id,
['case.can_create', 'case.can_delete']));
/* ["case.can_create"]=>
bool(false)
["case.can_delete"]=>
bool(true)
*/

6. Revoking Permissions
var_dump($this->unsetPermissionsForUser($user_id,
['case.can_edit','nonexistent']));
/* ["case.can_edit"]=>
bool(true)
["nonexistent"]=>
NULL
*/
var_dump($this->unsetPermissionsForUser($user_id,
['case.can_edit']));
/* ["case.can_edit"]=>
bool(false)
*/

7. Validating Permissions
$allowed_perms = $this->getPermissionsForUser($user_id, [
'case.can_create',
'case.can_edit',
'nonexistent’
]);
/* ["case.can_create"]=>
bool(true)
["case.can_edit"]=>
bool(false)
["nonexistent"]=>
NULL
*/

8. Performance Stress test
• 20k permissions
• 10k users - each 100 random permissions
• MySQL 5.7 backend, PHP 7.0
1000 samples for random user
Single lookup for:
• 3 permissions = 4-6ms
• 100 permissions = 10-12ms

9. Next Steps
• Multiple dimensions (User, Group, Entities,
etc.)
• Implement PDO
• Unit tests
• Documentation