How to store many items of data per SESSION? - coldfusion

Question

I have a query called "rsUserRights" which returns User Rights like such:
UserID | Entity | Right
-----------------------
1 Note Create
1 Note Edit
1 Note Delete
This means that UserID '1' can create, edit, or delete a Note object.
All I want to do this store these permissions in a SESSION array so that the web applications know all the time what rights the logged in User has. So when a User is looking at a Note object in my applciation, the correct option to Create, Edit, or Delete will be available depending on what rights this User has.
The application needs to know what object the user has a right to, and then what is that right. Some users may not have rights expect read-only. How do I store this Entity-Right key-value pair in a ColdFusion structure?
All I have managed to do so far is this:
<cfset SESSION.Auth.UserRights = StructNew()>
<cfloop query="rsUserRights">
<cfset SESSION.Auth.UserRights.#rsUserRights.Entity#>
<cfset SESSION.Auth.UserRights.#rsUserRights.Entity#.#rsUserRights.Right#>
</cfloop>
Would the above work? Then using structkeyexits to find value-pairs? The problem I can see is that I could end up with a shed load of SESSION variables because the user may have hundreds of rights to hundreds of entities/objects. It will therefore create hundreds of SESSION variables and crash my server?
FIRST ATTEMPT SOLUTION
<cfset SESSION.Auth.UserRights = StructNew()>
<cfloop query="rsUserRights">
<cfset SESSION.Auth.UserRights[rsUserRights.Entity][rsUserRights.Right] = StructNew()>
</cfloop>
Then in my CFM pages I test for the existence of SESSION.Auth.UserRights.Note AND SESSION.UserRights.Note.Create for example
Is this ok??

Answer 1

That absolutely can work. Personally I would create a structure that contains the rights already defaulted to false and then on login update to true for those that match.
The reason being that you can then just check the perms instead of having to also check existence, etc. note that you should be doing a cflock but I'll leave that out of this example.
<cfset SESSION.Auth.UserRights = {}>
<cfloop index="AuthRight" list="Note,User,Documents,Application,SomethingElse">
<cfset SESSION.Auth.UserRights[AuthRight]={Create=false,Edit=false,Delete=false}>
</cfloop>
<cfloop query="rsUserRights">
<cfset SESSION.Auth.UserRights[rsUserRights.Entity][rsUserRights.Right]=true>
</cfloop>

Answer 2

If you are concerned about how much memory this will take, then rather than loading lots of falses into your structure, only load when true.
<cfset SESSION.Auth.UserRights = {}>
<cfloop query="rsUserRights">
<cfset SESSION.Auth.UserRights[Entity] ={}>
<cfif Right EQ 1>
<cfif SESSION.Auth.UserRights[Entity][Right] = true>
</cfif>
</cfloop>
Then all of your tests are for existence.

Answer 3

You could take the approach that unix web server / CHMOD permissions have. They use a single integer to denote what actions are possible for a given user.
http://www.zzee.com/solutions/unix-permissions.shtml
You could adapt your numbering to match the particular possible actions your app has - for example you might have 1 = add only, 2 = add & edit only, 3 = full add, edit & delete. Then for a user you'd just have a single digit entry for each type of object in your app. Your code might look like:
<cfset SESSION.Auth.UserRights = structNew()>
<cfset SESSION.Auth.UserRights.Note = 3>
<cfset SESSION.Auth.UserRights.User = 1>
<cfset SESSION.Auth.UserRights.Image = 2>
Checking if a user has the right permissions then involves some simple logic - depending on what actions you've got and how you've organised your numbering. Something like this:
<cfif SESSION.Auth.UserRights.Image GT 2>…
<cfif SESSION.Auth.UserRights.Note EQ 1>
If you're REALLY worried about space (and I wouldn't be) then you could just store those integers in a single list / array, and check for the integer in a particular position - but that might be tricky to keep track of as your app evolves.
<cfset SESSION.Auth.UserRights = "3,1,2,3">
<cfdump var="#listToArray(SESSION.Auth.UserRights)#">
<cfoutput>#listToArray(SESSION.Auth.UserRights)[1]#</cfoutput>