Spatie Laravel Permission – Role and permission management

Spatie Laravel Permission is a powerful package that enables role and permission management in Laravel applications. It provides a straightforward way to handle user roles and permissions, making it easy to control access to various parts of your application based on user roles.

Key Features of Spatie Laravel Permission:

Role and Permission Management: Easily create and manage roles and permissions.
Middleware for Access Control: Provides middleware to restrict access to routes based on user roles and permissions.
Eloquent Models: Uses Eloquent models to manage roles and permissions, allowing for easy querying and relationship management.
Blade Directives: Includes Blade directives for checking roles and permissions directly in your views.
Customizable: Highly customizable, allowing you to define your own roles and permissions as needed.

Installation

To install and set up Spatie Laravel Permission, follow these steps:

Install the Package: Use Composer to require the package:

composer require spatie/laravel-permission

1

composer require spatie/laravel-permission
Publish the Migration and Config Files: Publish the migration files and the configuration file:

php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"

1

php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"
Run Migrations: Run the migrations to create the necessary tables for roles and permissions:

php artisan migrate

1

php artisan migrate
Add the HasRoles Trait: In your User model (app/Models/User.php), include the HasRoles trait:

use Spatie\Permission\Traits\HasRoles; class User extends Authenticatable { use HasRoles; }

1
2
3
4
5
6

use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable
{
use HasRoles;
}

Managing Roles and Permissions

1. Creating Roles and Permissions:

You can create roles and permissions using the provided Eloquent models.

Creating a Role:

use Spatie\Permission\Models\Role; Role::create(['name' => 'admin']);

1
2
3

use Spatie\Permission\Models\Role;

Role::create(['name' => 'admin']);
Creating a Permission:

use Spatie\Permission\Models\Permission; Permission::create(['name' => 'edit articles']);

1
2
3

use Spatie\Permission\Models\Permission;

Permission::create(['name' => 'edit articles']);

2. Assigning Roles and Permissions:

Once you’ve created roles and permissions, you can assign them to users.

Assigning a Role to a User:

$user->assignRole('admin');

1

$user->assignRole('admin');
Assigning a Permission to a Role:

$role = Role::findByName('admin'); $role->givePermissionTo('edit articles');

1
2

$role = Role::findByName('admin');
$role->givePermissionTo('edit articles');
Assigning a Permission Directly to a User:

$user->givePermissionTo('edit articles');

1

$user->givePermissionTo('edit articles');

3. Checking Roles and Permissions:

You can easily check if a user has a specific role or permission.

Check if a User has a Role:

if ($user->hasRole('admin')) { // The user is an admin }

1
2
3

if ($user->hasRole('admin')) {
// The user is an admin
}
Check if a User has a Permission:

if ($user->can('edit articles')) { // The user can edit articles }

1
2
3

if ($user->can('edit articles')) {
// The user can edit articles
}

Using Middleware

You can protect your routes by using middleware provided by the package. You can restrict access to specific roles or permissions.

1. Protecting Routes with Roles:

Route::group(['middleware' => ['role:admin']], function () {
    Route::get('/admin', function () {
        // Only accessible by admins
    });
});

Route::group(['middleware' => ['role:admin']], function () {

Route::get('/admin', function () {

// Only accessible by admins

});

2. Protecting Routes with Permissions:

Route::group(['middleware' => ['permission:edit articles']], function () {
    Route::get('/articles/edit', function () {
        // Only accessible to users with permission to edit articles
    });
});

Route::group(['middleware' => ['permission:edit articles']], function () {

Route::get('/articles/edit', function () {

// Only accessible to users with permission to edit articles

});

Blade Directives

Spatie Laravel Permission also provides Blade directives to check for roles and permissions directly in your views.

Check for a Role:

@role('admin') You are an admin! @endrole

1
2
3

@role('admin')
You are an admin!
@endrole
Check for a Permission:

@can('edit articles') You can edit articles! @endcan

1
2
3

@can('edit articles')
You can edit articles!
@endcan

Summary

Installation: Quick and easy to set up with Composer and migrations.
Role and Permission Management: Create, assign, and check roles and permissions using simple Eloquent methods.
Middleware: Protect routes based on roles and permissions.
Blade Integration: Use built-in directives for easy role and permission checks in views.

Conclusion

Spatie Laravel Permission is an excellent choice for managing roles and permissions in Laravel applications. It provides a clean API and integrates seamlessly with Laravel’s existing features, making it a powerful tool for access control.