How to setup Zend 2 ACL roles for single objects -

my simple data model: users can create articles, makes them owner of particular articles object. users can invite other users contribute on articles, makes other users contributors of particular article.

so, there roles owner , contributor , there resource article

now question is, how implement construct best, using zf2's acl , maybe bjyauthorize? struggle here, because roles of users not globally valid resource article, have assigned single article instance.

generally

i think, strength of zf2 acl inheritance of privileges according role structure , there acl-aware modules, menuhelper.

if not need inheritance or these other - acl-aware - modules, can create simple solution withouth acl module.

solution 1. - acl

resources, roles , privileges data. role mean, depends on store role in database or put in role, create structure authorization.

the isallowed method of acl object verification base upon data structure (of roles, resources , privileges) created, , can decide information.

what - think - need , object access control mechanism [can user/group of users (= role) write/read (= privilege) particular object (= resource)] besides feature access control [can user/goup of users (=role) write/read (= privilege) kind of object (= resource)].

so if store article resource, connect methods (write, read, delete etc) privilege , create relation these privileges given user / group, have achieved goal.

solution 2. - acl assertion

if store array of contributor users on articles, can use existence of to-check user in array assertion while creating "allow structure".

solution 2.1. - acl assertion - in separate table

you can store contributors in separated table, joined article table.

solution 3. - serialized array of contributors

if not need robust background of zf2 acl, can check existence of user in array of contributors stored on article.

i rather solution 1. centrally managed ac, see pros on solution 2. side too. (solution 1. mixes role , user definition, have seen mix of group , user objects, disturbs me not much. :))

listing article

an other thing consider: listing articles, 1 can edit (contributors). checking articles foreach there. using more/less direct database queries ruin zf2 acl philosophy. if need paginate too... problem. :)

there bunch of other solutions (and combinations of them) too. find right 1 have consider count of articles too. if store rows each contributor each article in role/resource/privilage tables, can grow fast.