Laravel Access Control – Advanced access control for users

Projects Inventory

1 month ago

Implementing advanced access control in Laravel allows you to manage user permissions and roles effectively. This can be done using Laravel’s built-in authorization features combined with packages like Laravel Permission by Spatie.

Step 1: Install Laravel

If you haven’t created a Laravel project yet, start by setting one up:

bash

composer create-project --prefer-dist laravel/laravel laravel-access-control
cd laravel-access-control

1 2	composer create-project --prefer-dist laravel/laravel laravel-access-control cd laravel-access-control

Step 2: Install Spatie Laravel Permission Package

Install the Spatie package for managing roles and permissions:

bash

composer require spatie/laravel-permission

1	composer require spatie/laravel-permission

Step 3: Publish the Configuration

Publish the package’s configuration file and migration:

bash

php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"

1	php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"

Step 4: Run Migrations

Run the migrations to create the necessary tables:

bash

php artisan migrate

1	php artisan migrate

Step 5: Set Up User Model

Add the HasRoles trait to your User model. This trait provides methods to assign roles and permissions to users.

php

namespace App\Models;

use Illuminate\Foundation\Auth\User as Authenticatable;
use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable
{
    use HasRoles;

    // Other model properties and methods...
}

namespace App\Models;

use Illuminate\Foundation\Auth\User as Authenticatable;

use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable

{

use HasRoles;

// Other model properties and methods...

}

Step 6: Create Roles and Permissions

You can create roles and permissions in your database. This can be done via a seeder or through the tinker console.

Using Tinker:

bash

php artisan tinker

1	php artisan tinker

Then run the following commands:

php

use Spatie\Permission\Models\Role;
use Spatie\Permission\Models\Permission;

// Create roles
$adminRole = Role::create(['name' => 'admin']);
$userRole = Role::create(['name' => 'user']);

// Create permissions
$editArticles = Permission::create(['name' => 'edit articles']);
$deleteArticles = Permission::create(['name' => 'delete articles']);

// Assign permissions to roles
$adminRole->givePermissionTo($editArticles);
$adminRole->givePermissionTo($deleteArticles);
$userRole->givePermissionTo($editArticles);

use Spatie\Permission\Models\Role;

use Spatie\Permission\Models\Permission;

// Create roles

$adminRole = Role::create(['name' => 'admin']);

$userRole = Role::create(['name' => 'user']);

// Create permissions

$editArticles = Permission::create(['name' => 'edit articles']);

$deleteArticles = Permission::create(['name' => 'delete articles']);

// Assign permissions to roles

$adminRole->givePermissionTo($editArticles);

$adminRole->givePermissionTo($deleteArticles);

$userRole->givePermissionTo($editArticles);

Using a Seeder:

Create a seeder:

bash

php artisan make:seeder RolePermissionSeeder

1	php artisan make:seeder RolePermissionSeeder

In RolePermissionSeeder.php, add:

php

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use Spatie\Permission\Models\Role;
use Spatie\Permission\Models\Permission;

class RolePermissionSeeder extends Seeder
{
    public function run()
    {
        // Create roles and permissions as before
    }
}

namespace Database\Seeders;

use Illuminate\Database\Seeder;

use Spatie\Permission\Models\Role;

use Spatie\Permission\Models\Permission;

class RolePermissionSeeder extends Seeder

{

public function run()

{

// Create roles and permissions as before

}

Don’t forget to call this seeder in DatabaseSeeder.php.

Step 7: Assign Roles to Users

You can assign roles to users like this:

php

$user = User::find(1);
$user->assignRole('admin'); // Assign admin role

1 2	$user = User::find(1); $user->assignRole('admin'); // Assign admin role

Step 8: Check Permissions in Controllers

You can check user permissions in your controllers using middleware or directly in methods:

Using Middleware:

First, register the middleware in app/Http/Kernel.php:

php

protected $routeMiddleware = [
    'role' => \Spatie\Permission\Middlewares\Role::class,
    'permission' => \Spatie\Permission\Middlewares\Permission::class,
];

protected $routeMiddleware = [

'role' => \Spatie\Permission\Middlewares\Role::class,

'permission' => \Spatie\Permission\Middlewares\Permission::class,

];

Then, use it in your routes:

php

Route::group(['middleware' => ['role:admin']], function () {
    Route::get('/admin/dashboard', [AdminController::class, 'index']);
});

Route::get('/articles/edit', [ArticleController::class, 'edit'])
    ->middleware('permission:edit articles');

Route::group(['middleware' => ['role:admin']], function () {

Route::get('/admin/dashboard', [AdminController::class, 'index']);

});

Route::get('/articles/edit', [ArticleController::class, 'edit'])

->middleware('permission:edit articles');

Directly in Methods:

You can also check permissions directly in controller methods:

php

public function edit($id)
{
    if (!auth()->user()->can('edit articles')) {
        abort(403);
    }

    // Edit logic here...
}

public function edit($id)

{

if (!auth()->user()->can('edit articles')) {

abort(403);

}

// Edit logic here...

}

Step 9: Using Gates and Policies

For more granular control, you can define gates and policies. Here’s how to define a gate:

Define a Gate:

In App\Providers\AuthServiceProvider.php:

php

use Illuminate\Support\Facades\Gate;

public function boot()
{
    $this->registerPolicies();

    Gate::define('edit-article', function ($user, $article) {
        return $user->id === $article->user_id || $user->hasRole('admin');
    });
}

use Illuminate\Support\Facades\Gate;

public function boot()

{

$this->registerPolicies();

Gate::define('edit-article', function ($user, $article) {

return $user->id === $article->user_id || $user->hasRole('admin');

});

}

Check the Gate:

In your controller:

php

public function edit(Article $article)
{
    if (Gate::denies('edit-article', $article)) {
        abort(403);
    }

    // Edit logic here...

public function edit(Article $article)

{

if (Gate::denies('edit-article', $article)) {

abort(403);

}

// Edit logic here...

Conclusion

With this setup, you have implemented an advanced access control system using roles and permissions in Laravel. By utilizing Spatie’s Laravel Permission package, you can efficiently manage user roles and permissions. This approach provides flexibility and scalability, allowing you to adapt as your application’s access control needs evolve.

Step 1: Install Laravel

Step 2: Install Spatie Laravel Permission Package

Step 3: Publish the Configuration

Step 4: Run Migrations

Step 5: Set Up User Model

Step 6: Create Roles and Permissions

Step 7: Assign Roles to Users

Step 8: Check Permissions in Controllers

Step 9: Using Gates and Policies

Conclusion

Related Posts: