[Fixed]-Best practice to handle different group of users accessing their own content

by

1👍

putting all the content together and allow users to access different content based on the company id that each entry associates with?

Personally, I would do this, for several reasons:

  1. It’s easier to maintain. Adding new companies probably just means a new ID, rather than a new schema and some tables.
  2. You can add security with application code or with database views.
  3. You can have other company specific functionality that uses the same design.

I would also suggest enforcing the data security on the database side, by only allowing the application to query from certain views, where the views are limited by company ID. This means that you won’t accidentally SELECT from a base table and forget the company filter, causing the user to see data that isn’t theirs.

This is just my opinion – happy to be proven otherwise.

👤bbrumm

Leave a comment