Virtual ACL for `Pointer<_Role>` field via CLP

New Feature / Enhancement Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.

Current Limitation

I am currently improving the authorization model of our application and researched in-depth what Parse offers and how I can leverage it in the best way. Our app basically provides a multi-tenant setup where users belong to a certain tenant and only have access to the data of that tenant. A user can have access data to multiple tenants. We plan on using a _Role for each tenant. This means, on each object we need to set the ACL for the object to that tenant role. That's fine and not a big deal, but I came across the virtual ACLs one can create by using a CLP for a Pointer<_User>. This kind of virtual ACL defined on CLP level is basically what we require - just not for a specific _User but for a specific _Role.

Feature / Enhancement Description

The idea for the enhancement would be to allow the pointer CLPs to either reference a _User (current state) or a _Role. Using a role pointer would then also create a virtual ACL for each object for that class.

Example Use Case

Apps with multi-tenant setup to separate data between tenants. Tenants can be represented as roles.

Alternatives / Workarounds

Use ACLs and set the ACL for a tenant _Role explicitly on each object for a class.

3rd Party References

No, but also have only limited experiences with other providers.

Start by tracing the existing pointer CLP handling for Pointer and its virtual ACL behavior. Determine how Pointer should resolve role membership and define tests covering multi-tenant access and denial; completion means role-based virtual ACLs work without explicitly setting ACLs on every object.