I'm building app to manage multi-level company employees.
So, therefore, my app is structured in the following way:
Company has many divisions.
Division has many sub-divisions.
Sub-division has many employees.
What I'm wondering is how do set up roles and permissions in smoothest manner, considering few requirements:
Super-admin - can do whatever he likes.
Manager - can manage ONLY one (his) division and all of the sub-divisions and employees that belongs to his division.
Coordinator - can manage one or more divisions with each sub-division that belongs to these divisions and all of the employees.
Group leader - can manage one or more subdivisions from all over the place.
One way that I'm thinking is to add few extra columns to user model, something like: division_id, subdivision_id, is_super_admin, but that fails given the fact that one user can have permissions for more than one division, subdivision etc.
Building permission for each and every division/subdivision isn't good, as there should be a lot of divisions/subdivisions.
How do I even get started with this, as I'm stuck for quite some time now.
Note: Every account should have all CRUD permissions allowed, but only for his division/subdivision/employees that he owns.
Thanks in advance!