mayconbordin/entrust-middleware

A Laravel 5 middleware for Entrust

entrust-middleware

A Laravel 5 middleware for Entrust., _(*1)

Installation

In order to install entrust-middleware, just add, _(*2)

    "mayconbordin/entrust-middleware": "dev-master"

to your composer.json. Then run composer install or composer update., _(*3)

Add the following line, _(*4)

'permissions' => 'Mayconbordin\Entrust\Middleware\Permissions'

to your app/Http/Kernel.php file in the $routeMiddleware array., _(*5)

Ownership Resolver

To use the middleware you need to implement the OwnershipResolverContract and register the binding interface to your implementation., _(*6)

The interface defines the method hasOwnership($permission, $user, Route $route), which must return a boolean. The idea is that sometimes a permission is conditional, meaning that the user can only access or do something to certain resource if he is the owner of such resource., _(*7)

Imagine, for example, a blog with multiple authors that can only edit their own posts. For the permission to be evaluated by the OwnershipResolverContract service it must have -own- in the name, in this case edit-own-post., _(*8)

The implementation of the contract would look something like this:, _(*9)

class OwnershipResolver implements OwnershipResolverContract
{
    public function hasOwnership($permission, $user, Route $route)
    {
        if ($permission == 'edit-own-post') {
            $post = Post::find($route->getParameter("id"));

            if ($post->author->id == $user->id) return true;
        }

        return false;
    }
}

You then register the implementation on the register method of AppServiceProvider:, _(*10)

$this->app->bind(
    'Mayconbordin\Entrust\Middleware\Contracts\OwnershipResolverContract',
    'App\Services\OwnershipResolver'
);

Usage

To check for a permission in a route:, _(*11)

Route::put('/posts/{id}', [
    'uses'        => 'PostController@edit',
    'middleware'  => 'permissions',
    'permissions' => 'edit-own-post'
]);

Or you can check for a role instead:, _(*12)

Route::put('/posts/{id}', [
    'uses'       => 'PostController@edit',
    'middleware' => 'permissions',
    'roles'      => 'admin'
]);

You can also check for both permissions and roles:, _(*13)

Route::put('/posts/{id}', [
    'uses'        => 'PostController@edit',
    'middleware'  => 'permissions',
    'permissions' => 'edit-own-post',
    'roles'       => 'admin'
]);

In this case the user must have either the permission or the role. At last, you can also list more than one permission or role:, _(*14)

Route::put('/posts/{id}', [
    'uses'        => 'PostController@edit',
    'middleware'  => 'permissions',
    'permissions' => ['edit-post', 'edit-own-post']
]);