2) is possible, one role per node wuth different users/groups assigned this role
The best option is to create a small extension which looks up the role if it exists, add/remove users/groups from the node specific role.
The hardest part will be the interface, but look at Kristof's AJAX extensions which provide the best ground to build upon for that
BTW: we need it too, just got a request from a collegue wanting the same ... no option to change their idea with predefined roles on subtrees and simplify their needs.
You're right, having one role per node and assign it to users is probably easier than one role per user and restrict it to nodes.
Probably a few tricky things to sort out, eg. no need to create a new role to grant right to someone that has already access rights because he's a member of a group that has access rights to it.
Do you have any idea of the impact on the performance ?
I've used Kristof's ajax, that's definitively the way to go.
As for the timing on my side, that's exploratory so far, just to see if it's possible and not too outside of the scope of ez. The dev (if it happends) is probably going ot be end of july/early august. I obvioulsy intend to let it GPL, let's talk privately once I've got more visibility on my side (or next time you're in BXL with Kristof, as he won't be able to go back home on his own with the amount of beer I'm going to feed him with ;)
On a second thought, a clever interface should not let the user grant access to a user that has already on this right, ie calculate the access right for each user. I'd guess that without ajax coating, that'd be paintfully slow.
