Re^2: User access controlled by subroutine attribute.

[rlb3]

Thanks for replying.

It's funny, I was listening to your talk on PDX.pm that got me thinking about Attribute::Handler. And I agree that your access control to objects works but I'm having this nagging feeling that using it for user access will have weird problems for users. Like a user getting so far into a program before they get an access denied. That may not be a bad thing. I'm just not sure.

[ikegami]

You could check permissions up front, and check it again at the function level as a failsafe. That way, your users won't normally get "far into a program" before getting an error.

[rlb3]

That is true but then there is no point of making access attached to each sub with an attribute.

[gellyfish]

I see it as protection from developer error. You probably want to have authorization handled in a way that allows you to both restrict the overt choices that a user can make and also to give the user a more friendly message up front, which all probably requires explicit coding nearer the front end. However if there is the possibility of an unintended method getting called (a typo in a dispatch table or an unchecked action parameter for instance,) then you might feel it is appropriate to prevent that method being called by unauthorized users. Call it a belt and braces approach.

/J\