I have a question. I am using the auth module and have the login and admin role. I also want the ability to add a deleted/banned/suspended status. At first I thought of just adding these additional roles to the user and at the same time remove the login role. Now I am thinking this will use an unnecessary amount of queries as every time a user object is returned I will need to check which role the user has and then decide what to display. Should non logged in roles be stored directly in the user object? Maybe it is more suited to add roles to users that are logged in?
On another auth topic. When I have the profiler activated I can see the queries done for each page. It is my understanding that after a login the auth module fetches the user object from the session and not from the DB. Yet on every page there is a "SELECT `users`.* FROM `users` WHERE `users`.`id` = 1 ORDER BY `users`.`id` ASC LIMIT 1" query. After this query the roles queries come. Is the user object really loaded from the session? Also, why can't also the roles be saved in the session to save additional queries?
I think the problem you'll come up against if you look into this is that ORM objects aren't cacheable (or serializable) because they point to a mysql resource identifier.