title: Tricky class design issue
body: <p>I'm working on implementing a class for managing user permissions on my website.</p>
  
  <p>For example: employees can view customer records but nothing else, employers can view customers as well as manage employees, and admins can do both those things as well as manage employers.</p>
  
  <p>So far, what I've got is this:</p>
  
  <ul>
  <li><p>I've stored a list of permissions, e.g <code>addCustomer</code>, <code>delCustomer</code>, etc. Each permission is linked to a list of the user roles which are allowed to do that action.</p></li>
  <li><p>I've got a simple permissions class built. I'm using it something like this:</p>
  
  <p>if ($permissions->can('addCustomer'))
     echo " Add Customer ";
  else
     echo 'Not allowed to add customers';</p></li>
  </ul>
  
  <p>However the tricky part is that in some places, I need to be more specific. For example: a customer has got the permission: <code>readMsgs</code> which allows him to read the messages between himself and an employee. However, if he has that permission, then he can simply change the url from:</p>
  
  <pre><code>site.com/messages/read/100
  </code></pre>
  
  <p>to</p>
  
  <pre><code>site.com/messages/read/101
  </code></pre>
  
  <p>And read message # 101 as well, which might be between another customer and employee. A customer shouldn't be able to read anyone's messages except himself.</p>
  
  <p>Similarly, a customer has got the <code>editCustomer</code> permission, which allows him to edit his own profile by going to:</p>
  
  <pre><code>site.com/customers/99
  </code></pre>
  
  <p>(where 99 is his customer id)</p>
  
  <p>But if he goes to
      site.com/customers/100</p>
  
  <p>He should not be allowed to access that page.</p>
  
  <p>How can I solve this problem? Ideally I'd like to be able to pass on an id to the permissions class. E.g:</p>
  
  <pre><code>if (! $permissions-&gt;can('readMsg', $msgId))
     echo 'not allowed';
  
  if (! $permissions-&gt;can('editCustomer', $requestedCustomerId))
     echo 'not allowed';
  </code></pre>
  
  <p>Any ideas how I'd have to restructure my class structure to allow the above kind of thing?</p>