beghelli/omp — comment on commit 77dc8051dd87316277ec856c8a7a8de50513aa05
File: classes/security/authorization/internal/SeriesAssignmentRule.inc.php line 3
By beghelli:

I did this following the XACML concepts: they use one more level to define policies, that is the rule. Rules can be reused by policies, and that's what I thought I needed in this case, because we use this rule in two places now: the SeriesAssignmentPolicy and the UserAccessibleWorkflowStagePolicy.

So, I just wanted to keep this encapsulated somewhere, to hide the implementation details and, especially, to make easier to find where this logic is being used. Because we are dealing with security, I thought it was a good idea if we have explicit places that define our policies. If we want to change it later, it will be just in one place. This is the case that came to my mind: for some reason, we need to insert another piece of code to check if the editor is assigned to the current series. Then, if we don't have this class, the developer will change the SeriesAssignmentPolicy and then will think that's done. But the UserAccessibleWorkflowStagePolicy will still be using the previous series assignment code. Without this class it's harder to make a change without breaking one of those two policies, I think.

Conceptually I was very convinced that this was necessary, but I must confess that when I created this class I saw that the code there was too little and it makes me think twice. But I thought the tradeoff was worthwhile. If you think that's not, I can refactor this quickly, of course. :)