I am building a web-application in NodeJS (using TypeScript) and MongoDB (using Mongoose).In my application I have 6 types of permissions.  For the simplicity, let's use P1, P2, ..., P6 to represent my permissions. In addition, the application has several organizations.Each user in the application belongs to one organization and can have several permissions (P1-P6) for each organization (not necessarily the one he belongs to).For example: - User U1 belongs to O1 organization, has permissions P1, P3 in organization O1 and permissions P2, P6 in organization O2.- User U2 belongs to O2 organization, has permission P1 in organization O2.- User U3 belongs to O1 organization, has no permissions.I am trying to implement this structure in the user schema (using Mongoose schema) and need some opinions about my implementations.This is my user schema:var userSchema: mongoose.Schema = new mongoose.Schema({    _id: {        type: String    },    firstName: {        type: String,        required: true    },    lastName: {        type: String,        required: true    },    mail: {        type: String,        required: true,        unique: true    },    organization: { // User's organization        type: mongoose.Schema.Types.ObjectId,        ref: 'Organization'    },    permissions: [{        organization: {            type: mongoose.Schema.Types.ObjectId,            ref: 'Organization'        },         permissions: [{            type: String,            enum: [                Permission.P1,                Permission.P2,                Permission.P3,                Permission.P4,                Permission.P5,                Permission.P6,            ]        }]    }]});For the permissions enum I use:export enum Permission {    P1 = <any>'P1',    P2 = <any>'P2',    P3 = <any>'P3',    P4 = <any>'P4',    P5 = <any>'P5',    P6 = <any>'P6',}I use this enum as string values because I think it's better to have the string value of the permission and not just the enum number values (1-6). Of course, the permission names (P1-P6) are replaced with the real permission name - for example, P1 is Administrator.I am not sure about my current implementation and would like to get some opinions whether I am doing good or should I change something.
Implementation of user permissions
javascript;node.js;mongodb;mongoose