Scaling Bitmasking: Mastering Permissions Beyond 64 Bits with Multiple Masks

// app/Permissions/BlogPermissions.php
const BLOG_PERMISSION_FLAGS = [
    "BLOG_CREATE" => 1 << 0,  // 1
    "BLOG_READ"   => 1 << 1,  // 2
    "BLOG_UPDATE" => 1 << 2,  // 4
    "BLOG_DELETE" => 1 << 3,  // 8
    "BLOG_PUBLISH" => 1 << 4, // 16
    // ... up to 64 blog-specific permissions
];

// app/Permissions/UserPermissions.php
const USER_PERMISSION_FLAGS = [
    "USER_CREATE" => 1 << 0,  // 1
    "USER_READ"   => 1 << 1,  // 2
    "USER_UPDATE" => 1 << 2,  // 4
    "USER_DELETE" => 1 << 3,  // 8
    "USER_RESET_PASSWORD" => 1 << 4, // 16
    // ... up to 64 user-specific permissions
];

// And your JWT payload might now look like this:
{
  "iss": "your-auth-server.com",
  "exp": 1735689600,
  "userid": "user123",
  "email": "user@example.com",
  "blogMask": 27, // Example: BLOG_CREATE (1), BLOG_READ (2), BLOG_PUBLISH (16) + 8 = 27
  "userMask": 7  // Example: USER_CREATE (1), USER_READ (2), USER_UPDATE (4) = 7
}

<?php

// Assume these constants are loaded/imported from their respective files
require_once 'app/Permissions/BlogPermissions.php';
require_once 'app/Permissions/UserPermissions.php';

// A single function to calculate a mask for a given set of permissions and a flag group
function calculateSpecificPermissionMask(array $permissionNames, array $flagGroup): int {
    $mask = 0;
    foreach ($permissionNames as $name) {
        if (isset($flagGroup[$name])) {
            $mask |= $flagGroup[$name];
        }
    }
    return $mask;
}

// Example usage to get user's total masks (e.g., from database)
function getUserAllPermissions(string $userId): array {
    // In a real app, you'd fetch user roles/permissions from DB,
    // then map them to the correct flag groups.
    // This is just a conceptual example:
    $rawBlogPermissions = ["BLOG_READ", "BLOG_CREATE", "BLOG_PUBLISH"];
    $rawUserPermissions = ["USER_READ", "USER_UPDATE"];

    $blogMask = calculateSpecificPermissionMask($rawBlogPermissions, BLOG_PERMISSION_FLAGS);
    $userMask = calculateSpecificPermissionMask($rawUserPermissions, USER_PERMISSION_FLAGS);

    return [
        'blogMask' => $blogMask,
        'userMask' => $userMask
    ];
}

// Function to check a specific permission within a specific mask
function hasSpecificPermission(int $userMask, string $permissionName, array $flagGroup): bool {
    if (!isset($flagGroup[$permissionName])) {
        return false; // Permission not defined in this group
    }
    return ($userMask & $flagGroup[$permissionName]) !== 0;
}

// --- Let's see it in action! ---
$userMasks = getUserAllPermissions("user123");
$userBlogMask = $userMasks['blogMask'];
$userUserMask = $userMasks['userMask'];

echo "User Blog Mask: " . $userBlogMask . "\n"; // e.g., 27
echo "User User Mask: " . $userUserMask . "\n"; // e.g., 7

echo "Can user create a blog post? " . (hasSpecificPermission($userBlogMask, "BLOG_CREATE", BLOG_PERMISSION_FLAGS) ? "Yes!" : "No.") . "\n";
echo "Can user delete a blog post? " . (hasSpecificPermission($userBlogMask, "BLOG_DELETE", BLOG_PERMISSION_FLAGS) ? "Yes!" : "No.") . "\n";
echo "Can user reset another user's password? " . (hasSpecificPermission($userUserMask, "USER_RESET_PASSWORD", USER_PERMISSION_FLAGS) ? "Absolutely!" : "Nope.") . "\n";

// When creating the JWT payload:
$jwtPayload = [
    // ... other claims ...
    'blogMask' => $userBlogMask,
    'userMask' => $userUserMask
];
// Encode this payload into your JWT
?>

// Ensure these flag groups match your backend definitions!
const BLOG_PERMISSION_FLAGS_JS = {
    "BLOG_CREATE": 1 << 0, "BLOG_READ": 1 << 1, "BLOG_UPDATE": 1 << 2,
    "BLOG_DELETE": 1 << 3, "BLOG_PUBLISH": 1 << 4
};

const USER_PERMISSION_FLAGS_JS = {
    "USER_CREATE": 1 << 0, "USER_READ": 1 << 1, "USER_UPDATE": 1 << 2,
    "USER_DELETE": 1 << 3, "USER_RESET_PASSWORD": 1 << 4
};

// Assume this is your decoded JWT payload
const decodedJwtPayload = {
  "iss": "your-auth-server.com",
  "exp": 1735689600,
  "userid": "user123",
  "email": "user@example.com",
  "blogMask": 27, // Example from backend
  "userMask": 7   // Example from backend
};

// Generic function to check permission against a specific mask type
function checkPermission(maskValue, permissionName, flagGroup) {
    if (!(permissionName in flagGroup)) {
        return false;
    }
    return (maskValue & flagGroup[permissionName]) !== 0;
}

// --- How the Frontend uses it for UI! ---
const userBlogMask = decodedJwtPayload.blogMask;
const userUserMask = decodedJwtPayload.userMask;

// Example for a blog-related button
const createBlogPostButton = document.getElementById('createBlogPostButton');
if (createBlogPostButton) {
    if (checkPermission(userBlogMask, "BLOG_CREATE", BLOG_PERMISSION_FLAGS_JS)) {
        createBlogPostButton.style.display = 'block';
    } else {
        createBlogPostButton.style.display = 'none';
    }
}

// Example for a user management feature
const resetUserPasswordFeature = document.getElementById('resetUserPasswordFeature');
if (resetUserPasswordFeature) {
    if (checkPermission(userUserMask, "USER_RESET_PASSWORD", USER_PERMISSION_FLAGS_JS)) {
        resetUserPasswordFeature.style.display = 'block';
    } else {
        resetUserPasswordFeature.style.display = 'none';
    }
}

console.log("Can view blog posts? ", checkPermission(userBlogMask, "BLOG_READ", BLOG_PERMISSION_FLAGS_JS) ? "Yes!" : "No.");
console.log("Can create users? ", checkPermission(userUserMask, "USER_CREATE", USER_PERMISSION_FLAGS_JS) ? "Yes!" : "No.");