I have a system where Admin can manage doctors and doctor has ability to manage itself. For this, I am using Laravel Authorization using policies. I registered a policy for admins that it can access doctors like:
Route::resource('doctors', 'DoctorsController')->middleware('can:access-doctors, App\Doctor');
But what I need is a separate policy for just one route out of resource group i.e. doctors.edit so a doctor can edit own profile like: can:edit-doctor, $doctor something.
Is there a possibility to do this in a proper way or I have to make manual routes and assign policies rather than using resource routes???
If I'm not wrong, you'll need a different endpoint to specify specific middlewares for each route.
You could do:
Route::get('doctors/{doctor}/edit', 'DoctorsController#edit')
->middleware('can:edit-doctor', 'App\Doctor'));
Route::put('doctors/{doctor}', 'DoctorsController#update')
->middleware('can:edit-doctor', 'App\Doctor'));
Route::resource('doctors', 'DoctorsController')
->except(['edit', 'update'])
->middleware('can:access-doctors, App\Doctor'));
Related
I am building a eCommerce platform. Where I have to make several user roles and specific permission for them. I have successfully created admin and default user roles and permission.
But I am getting so much trouble to show the views and menu items based on other user roles like Editor/Manager/CS Team.
I tried to do using different middleware for every one of them. But It's not working efficiently and even at all.
For the Admin role, I created a Admin Middleware where I am checking user role type and giving access. I defined the admin middleware on Route gruop.
Can you suggest me? - how to setup permission/views/menu items efficiently for different user roles?
Thanks in Advance.
Note: I am trying to do it without any package.
Yes you can make your own custom build library by setting roles,permission table in database and as soon as the user log's in you put all that information in session or cache. But doing so might get you in trouble in future coz lack of testing it's all feature, You have to be sure what exactly you are doing to manage it by yourself or else you can use already tested many time library like
laravel-permission
Using a well known and trusted library ensures that it will solve your problem, but take your time to read it's documentation and analyse if it contains all features that you want in your application.
You need to define policy.
Policies are a great way to protect actions on your Eloquent Model. Laravel Policies are the part of Laravel Authorization that helps you to protect resources from unauthorized access.
Please refer this documentation to how to register policy and how it works in views file:
https://www.larashout.com/laravel-policies-controlling-authorization-in-laravel
I have been working on a project using php with laravel for a week now, I just want to make sure I am following the best practices.
I really like the idea of Resource controllers and CRUD, they make sense and I chose to follow this approach. However, should I be using them on a model where different users have different access rights on it?
suppose I have different types of users (user, admin, agent) that have different access rights on the same models. Which of the following approaches is more appropriate for this case?
Create a normal controller for each user type along with its middleware that authorizes the access to this controller. Then add a route to that controller with that middleware.
Create a resource controller for each resource (model), create a route group for each user type containing all routes for this user type from the defined controllers along with a middleware for this route group.
In other words, where both of the following are possible, should controllers definition be based on user type or resources themselves?
Personally I name my controllers based on the resources and then handle the roles/user types via middlewares
I have got a web project which has 3 types of users, say root admin, a super admin and kitchen admin. Each user or role has different functionalities: root admin will create super admin and other small functionalities, same way super admin would be creating kitchen admin and other functionalities and kitchen admin has its own functionalities say handling orders.
I wanted to know whether would it be a good idea to make separate laravel setup for each users or all these users can be developed in one laravel setup?
A small lead on this would be a great help since I am new at laravel.
You could make separate setups for each users. That would work. But would also be difficult to maintain and you might have to write some functions 3 times (login, logout, CRUD, etc.).
However, you could create a single project using Authorizations. Out of the box, Laravel gives you an easy way to authorize and restrict some actions via Gate or restrict models via Policy. You could also restrict URLs via Middleware. See you have 3 different ways of restricting actions.
My personal preference is Policy because it's bound to the model. You have a list of permissions and give each role their permissions, eg.: 'create_sys_admin'. Then link this permission to the 'root_admin' role. so in your policy you can write:
public function createSysAdmin(User $user) {
return $user->role->permissions->contains('create_sys_admin');
}
With the policy defined, we can check for propser permission in the controller. In any function in your controller you can always check for proper permissions
if ( Auth::user()->cant('create_sys_admin', User::class) ) {
return redirect()->back()->withErrors(['authorization' => 'You are not authorized to perform that action']);
}
That was just one way. As I previously said, you have Gates and Middlewares as well. Read more here: https://laravel.com/docs/5.4/authorization
If you want something already made, you can use this package: https://github.com/Zizaco/entrust.
I am new to Laravel, and currently I am developing a job website project using Laravel 5. In the website, in addition to the Admin user, I have three types of users- jobseeker, employer, and training provider, which I want to seperate the three tables because each of them store different information. Plus, each of them should go to certain allowed user logged in area. For example, logged job seeker can only work on their allowed area, and employer and training provider can do the same thing.
Could you advise me how to manage authentication for each tables?
Best Regards,
Naren
The best way to manage this in Laravel is use a plugin. Try this: Laravel ACL
It uses following table to manage role based access for entire application:
users
role_user
roles
permissions
permission_role
permission_user
By using this module you can manage role wise as well as individual person permission also.
You can apply the following stuffs from Laravel 5.2+,
Use multi authentication. So each type of user has its own model: JobSeeker, Employer, TrainingProvider. They will have their own Guard in middleware for authentication.
Routes are protected via middleware. Some routes are permitted to all, some are personal...
Since each role might have same or different access to some type of actions, ex. all have access the JobSeeker profile (to view), but only JobSeeker can edit the profile. Use the Laravel Policy.
My actual project needs to implement an ACL for the diferent roles in my users.
For now, I have like 4 roles defined by the client (Administrator, Head of Departament, Secretary and Teachers) but he wants to create more roles whenever he needs it.
Knowing this the clue is I want to know if is there any way to control the system access without checking the access in each method of my system. Laravel provides my the Authorization services but is not enough for the desing of my system, but I think is a deprecated way checking every method.
My idea is implement something before enrouting any request and check if the user has access depending on his roles, in this way I won't need to check it in every method as the actual solution that laravel Authorization services, laravel-acl of Kodeine or similars offers me.
If someone has an idea to set forth this Idea please answer this.
Also I want to know if this could affect the system security and how and how I can handle that.
Thanks in advance.
If you want to use role-base access control only, it's very easy to create own middleware where you check passed roles. Now in your routes you can protect routes depending on user roles, for example:
Route::group(['middleware' => 'authorize:admin,secretary'], function() {
// your route here
});
You have sample role middleware in Laravel documentation here.