ipunkt/permissions
Check your permissions with a simple 1-liner: $user->can('do something', $onAnObject), (*1)
About
The goal of this package is to extract your permission checking code from both your controller and your model.
Instead, each Model brings its own PermissionChecker object which then does the permission checking., (*2)
Install
Installation
Add to your composer.json following lines, (*3)
"require": {
"ipunkt/permissions": "dev-master"
}
Configuration
Add, (*4)
'Ipunkt\Permissions\PermissionsServiceProvider'
to your service provider list, (*5)
Use
Have your Usermodel implement CanInterface and use CanTrait
Have the Models you with to perform permission checks on implement HasPermissionInterface and use HasPermissionTrait, (*6)
This will allow you to do $user->can('doSomething', $model);, (*7)
Simple use
Pull in another package which handles permission management and set permissions through is., (*8)
Known packages which have ipunkt/permissions support out of the box:
- ipunkt/roles, (*9)
Dynamic Permissions
Usualy, you do not want to create an individual role and permission per user to edit their own profile, even if you
have a system to do so. To address this, you can switch out the PermissionChecker object for your models., (*10)
<?PHP
namespace Example;
class ModelPermissionChecker extends PermissionChecker {
public function checkPermission(CanInterface $user, $action) {
// Give permission to do anything if the $user is the owner of this model
if( $user->getId() == $this->getEntity()->owner->getKey() )
return true;
// If the $user is not the owner, fall back to the usual permission management
return parent::checkPermission($user, $action);
}
}
class Model extends Eloquent implements HasPermissioninterface {
use HasPermissionTrait;
$checker_instance = 'Example\ModelPermissionChecker';
}
Why the CanTrait
The actual work of this package is done in the PermissionChecker, and finding the right PermissionChecker is done in the
HasPermissionTrait. So why go the detour of $user->can('something', $onSomething) instead of directly using
$onSomething->checkPermission($user, 'something');?, (*11)
- First is readability. $user->can('doSomething', $onSomething) reads very natural and improves how easy it is to
understand the code.
-
Second is extendability.
Lets say you're just starting out on your project. You already chose your permission checking package, but you don't
want to bother with giving your testuser permissions to every single resource, so you just define that the user with
id 0 is the super user.
With $onSomething->checkPermission($user, 'doSomething') you'd have to change every single permission check to
if( $user->getId() == 0 || $onSomething->checkPermission($user, 'doSomething') ) or go into every single
PermissionChecker you made and do it here.
With the CanInterface and Trait you can just do, (*12)
class User implements CanInterface {
use CanTrait {
CanTrait::can as _can;
};
public function can($action, HasPermissionInterface $object) {
$permission = false;
if($this->getKey() == 0)
$permission = true;
else
$permission = _can($action, $object);
return $permission;
}
}
and maintain the code in a single location., (*13)
Wallogit.com
