Laravel RBAC
Laravel 5 RBAC implementation, (*1)
Package was inspired by RBAC module from Yii Framework, (*2)
Installation
-
Run, (*3)
composer require "smart-crowd/laravel-rbac":"dev-master"
-
Add service provider and facade into /config/app.php file., (*4)
'providers' => [
...
SmartCrowd\Rbac\RbacServiceProvider::class,
],
...
'aliases' => [
...
'Rbac' => 'SmartCrowd\Rbac\Facades\Rbac'
]
-
Publish package configs, (*5)
php artisan vendor:publish
-
Implement Assignable contract in your user model. And use AllowedTrait., (*6)
use SmartCrowd\Rbac\Traits\AllowedTrait;
use SmartCrowd\Rbac\Contracts\Assignable;
class User extends Model implements Assignable
{
use AllowedTrait;
/**
* Should return array of permissions and roles names,
* assigned to user.
*
* @return array Array of user assignments.
*/
public function getAssignments()
{
// your implementation here
}
...
}
Usage
-
Describe you permissions in /Rbac/items.php, (*7)
-
Use inline in code, (*8)
if (Auth::user()->allowed('article.delete', ['article' => $article])) {
// user has access to 'somePermission.name' permission
}
-
Or in middleware, (*9)
Route::delete('/articles/{article}', [
'middleware' => 'rbac:article.delete',
'uses' => 'ArticlesController@delete'
]);
Of course, don't forget to register middleware in /Http/Kernel.php file, (*10)
protected $routeMiddleware = [
...
'rbac' => 'SmartCrowd\Rbac\Middleware\RbacMiddleware',
];
To use route parameters in business rules as models instead just ids, you should bind it in RouteServicePrivider.php:, (*11)
public function boot(Router $router)
{
//...
$router->model('article', '\App\Article');
parent::boot($router);
}
There are 3 ways to bind permission name to action name:, (*12)
- middleware paramenter
- bind they directelly in
/Rbac/actions.php file
- name permission like action, for example
article.edit for ArticleController@edit action
-
Or in your views, (*13)
@allowed('article.edit', ['article' => $article])
<a href="{{ route('edit', ['article' => $article]) }}">edit</a>
@else
<span>You can not edit this article</span>
@endallowed
If rbac.shortDirectives option are enabled, you can use shorter forms of directives, like this:, (*14)
@allowedArticleEdit(['article' => $article])
{{ $some }}
@endallowed
@allowedIndex
{{ $some }}
@endallowed
Context Roles
In some cases, you may want to have dynamically assigned roles. For example, the role groupModerator is dynamic, because depending on the current group, the current user may have this role, or may not have. In our terminology, this role are "Context Role", and current group is "Role Context". The context decides which additional context roles will be assigned to the current user. In our case, Group model should implement RbacContext interface, and method getAssignments($user)., (*15)
When checking is enough to send context model among other parameters:, (*16)
@allowed('group.post.delete', ['post' => $post, 'group' => $group]) // or $post->group
post delete button
@endallowed
But for automatic route check in middleware we usually send only post without group:, (*17)
Route::delete('/post/{post}', [
'middleware' => 'rbac:group.post.delete',
'uses' => 'PostController@delete'
]);
For this case you can implement RbacContextAccesor intarface by Post model. getContext() method should return Group model. Then you just have to send only the post, and context roles will be applied in middleware to:, (*18)
@allowed('group.post.delete', ['post' => $post])
post delete button
@endallowed
You can not do that, if you send context with subject:, (*19)
Route::delete('/group/{group}/post/{post}', [
'middleware' => 'rbac:group.post.delete',
'uses' => 'PostController@delete'
]);
Wallogit.com
