Summary of the Feature Request

Oct 13, 2025 by thesweetdesigns.com 87 views

Summary of the Feature Request

Currently, HIPPO provides only coarse-grained access control through global READ privileges, making all products visible to any user with this privilege. This issue proposes two interconnected features to enable fine-grained access management:

User Groups: Create a group management system allowing users to be organized into groups with inherited permissions
Access Visibility Control: Implement product-level and collection-level permission rules that respect both direct user permissions and group-inherited permissions

Core Idea

The User can access (any of a hierarchical permission from 'READ', 'UPDATE', 'EXECUTE') a product if they have direct permission OR inherited permission through any group they belong to. Collections are only visible if the user can access at least one product within them with only those products to be visible which the User has access to.

i.e. Product Gatekeeping:

ProductAccess = Direct User Permissions ⋃ Group Inherited Permissions

and Collection Gatekeeping:

CollectionVisibility = ∃ Product ∈ Collection : UserAccess(Product)

Details on Implementation

Proposed Database Update

To implement the proposed features, we need to update the database schema to include the following changes:

class PermissionLevel(str, Enum):
  '''
  Defines hierarchical permission levels for access control:
  - EXECUTE: Administrative access.
  - UPDATE: Update Product details.
  - READ: View-only access to Products.
  - NONE: No access permissions.
  '''
  NONE = "none"
  READ = "read"
  UPDATE = "update"
  EXECUTE = "execute" 

class Group(Document):
	'''
	Represents a user group.
	- name: Unique identifier for group.
	- members: List of linked `User` objects belonging to this group.
	'''
    name: Indexed(str, unique=True)
    members: list[Link[User]] = []

class User(Document):
	'''
	Represents an individual user in the system.
	- groups: Links to `Group` objects.
	'''

    # existing fields...
    groups: list[Link[Group]] = []

class Product(Document):
	'''
	Both Group and User Access Defined in a Dictionary format
	'''
    # existing fields...
    user_access: Dict[str, PermissionLevel] = {}  # user_name -> permission
    group_access: Dict[str, PermissionLevel] = {}  # group_name -> permission

class Collection(Document):
    '''
	Both Group and User Access Defined in a Dictionary format.    
    '''
    # existing fields...
    user_access: Dict[str, PermissionLevel] = {} # user_name -> permission
    group_access: Dict[str, PermissionLevel] = {} # group_name -> permission
    product_permissions: Dict[str, Dict[str, PermissionLevel]] = {} #  Outer key: Product identifier (product name). Inner dictionary: Maps user/group to their respective permission levels (e.g., {'user1': 'read', 'group1': 'update'})

Access Gatekeeping

Generalized Product Gatekeeping

To determine if a user or their group has the required permission level for a given product, we can use the following function:

async def has_product_permission(user: User, product: Product, req_permission: PermissionLevel):
    '''
	Determines if a user or their group has the required permission level for a given product through permission hierarchy comparison.
	'''
	_DEFAULT =  PermissionLevel.NONE
    permission_strength = {
        PermissionLevel.NONE: 0,
        PermissionLevel.READ: 1,
        PermissionLevel.UPDATE: 2,
        PermissionLevel.EXECUTE: 3
    }
    
    max_level = permission_strength[PermissionLevel.NONE]
    req_level = permission_strength[req_permission]

    def get_max_permission(source):
        nonlocal max_level
        # Check user permissions
        user_perm = source.user_access.get(user.name,_DEFAULT)
        max_level = max(max_level, permission_strength[user_perm])
        
        # Check group permissions
        for group in user.groups:
            group_perm = source.group_access.get(group.name, _DEFAULT)
            max_level = max(max_level, permission_strength[group_perm])

    # Check direct product permissions
    get_max_permission(product)

    # Check collection-based permissions
    for collection in product.collections:
        # Collection-level permissions
        get_max_permission(collection)
        
        # Product-specific permissions within collection
        product_perms = collection.product_permissions.get(product.name, {})
        user_perm = product_perms.get(user.name, _DEFAULT)
        max_level = max(max_level, permission_strength[user_perm])
        
        for group in user.groups:
            group_perm = product_perms.get(group.name, _DEFAULT)
            max_level = max(max_level, permission_strength[group_perm])

    if max_level >= req_level:
        return True
    raise PermissionError(f"Requires {req_permission.name} access (current: {max_level})")

Collection Gatekeeping

To determine if a collection is visible to a user, we can use the following function:

async def collection_visible(user: User, collection: Collection, req_permission: PermissionLevel):
    return any(
        has_product_permission(user, product, req_permission)
        for product in collection.products
    )

Benefits of User Groups and Granular Visibility Access Control

The proposed features provide several benefits, including:

Improved security: By allowing users to be organized into groups with inherited permissions, we can improve the security of our system by limiting access to sensitive data and features.
Increased flexibility: The proposed features provide a high degree of flexibility, allowing administrators to create custom permission rules and group hierarchies that meet the needs of their organization.
Simplified access management: By providing a centralized system for managing user permissions and group memberships, we can simplify access management and reduce the risk of errors or inconsistencies.

Conclusion

Q: What is the purpose of user groups in the proposed feature?

A: The purpose of user groups is to allow users to be organized into groups with inherited permissions. This enables administrators to create custom permission rules and group hierarchies that meet the needs of their organization.

Q: How do user groups inherit permissions?

A: User groups inherit permissions from the group's membership. When a user is added to a group, they inherit the group's permissions. This allows administrators to create a hierarchy of groups with different levels of access.

Q: What is the benefit of using a dictionary to store user and group permissions?

A: Using a dictionary to store user and group permissions provides a flexible and efficient way to store and retrieve permission data. It allows for easy addition and removal of users and groups, and enables administrators to create custom permission rules.

Q: How does the `has_product_permission` function determine if a user or group has the required permission level for a product?

A: The has_product_permission function uses a permission hierarchy comparison to determine if a user or group has the required permission level for a product. It checks the user's direct permissions, as well as the group's inherited permissions, to determine if the user has the required level of access.

Q: What is the purpose of the `collection_visible` function?

A: The collection_visible function determines if a collection is visible to a user based on their permissions. It checks if the user has access to any of the products within the collection, and returns True if they do.

Q: How does the proposed feature improve security?

A: The proposed feature improves security by providing a centralized system for managing user permissions and group memberships. This allows administrators to create custom permission rules and group hierarchies that meet the needs of their organization, and reduces the risk of errors or inconsistencies.

Q: What is the benefit of using an asynchronous function to check permissions?

A: Using an asynchronous function to check permissions allows for efficient and concurrent permission checks. This enables administrators to quickly and easily check permissions for multiple users and groups, and reduces the risk of performance issues.

Q: How does the proposed feature simplify access management?

A: The proposed feature simplifies access management by providing a centralized system for managing user permissions and group memberships. This allows administrators to easily create and manage custom permission rules and group hierarchies, and reduces the risk of errors or inconsistencies.

Q: What is the benefit of using a permission hierarchy comparison to determine if a user or group has the required permission level for a product?

A: Using a permission hierarchy comparison to determine if a user or group has the required permission level for a product provides a flexible and efficient way to check permissions. It allows administrators to create custom permission rules and group hierarchies that meet the needs of their organization, and reduces the risk of errors or inconsistencies.

Q: How does the proposed feature improve flexibility?

A: The proposed feature improves flexibility by providing a high degree of flexibility in creating custom permission rules and group hierarchies. This allows administrators to create a system that meets the needs of their organization, and reduces the risk of errors or inconsistencies.

Q: What is the benefit of using a dictionary to store product permissions?

A: Using a dictionary to store product permissions provides a flexible and efficient way to store and retrieve permission data. It allows for easy addition and removal of products, and enables administrators to create custom permission rules.