Hi, I have a question about a design pattern. In my application, I have some users with the rights (patient-edition or patient-access-all). With these rights, the user can access for all patients or can update the patient. I have a definition (patient) like this :

definition patient {
    relation owner: user
    relation doctor: user
    relation technician: user

    permission read = owner + doctor + technician
    permission write = owner + doctor + technician
  }

But I would like to verify the user right inside the read / write permission. I don't know if the right must be define in the user definition or somewhere else. Is there a design pattern for user right ? thanks

👋🏻 I'm not sure I understand what you mean with "verify the user right inside the read/write permission", can you elaborate?

For exemple : - Read: owner OR doctor OR technician OR user have the right 'patient-access-all' can access of the ressource patient - Write: (owner OR doctor OR technician OR user have the right 'patient-access-all' ) AND the user have the right 'patient-edition' can update the patient. Let me know if it's more clear. thanks

I can think of creating a top level definition that holds those "patient-access-all" and "patient-edit-all", as if you assigned the role system-wide:

definition platform {
    relation patient_reader: user
    relation patient_writer: user
    
    relation read: patient_reader + write
    relation write: patient_writer
  }

  definition patient {
    relation platform: platform
    relation owner: user
    relation doctor: user
    relation technician: user

    permission read = write + platform#read
    permission write = owner + doctor + technician + platform#write
  }

Ok, I see for the platform definition. Inside the platform definition. Can I set all possible user rights like this :

definition platform {
    relation patient_reader: user
    relation patient_writer: user
    relation patient_creation: user
    relation manage_all_user: user
    relation prescription_creator
.....
   
    permission patient_read: patient_reader + write
    permission patient_write: patient_writer
.....
  }

I have lot of possible right for the users of my application. I would like to be sure where I have to store them.

yeah that sounds about right