module Authorization
  module User
    # include ::DataMapper::Resource
    # This is a "vanity" relationship.  A user may not have all permissions for an entire role,
    # but still may be said to be a member of the role.
    # has_and_belongs_to_many :roles
    has 1.0/0, :roles, :through => ::DataMapper::Resource

    # This relationship contains the actual list of permissions the user has been granted.
    has 1.0/0, :permissions, :through => ::DataMapper::Resource

    before :save, :assign_role

    def revoke_role(role)
#...
end