laravel-package laravel-lpermissions

leoche/laravel-lpermissions

Users Roles & Permissions for routes

, _(*1)

, _(*2)

Laravel LPermissions adds roles and permissions to Auth Laravel 5.3. Protect your routes and your views., _(*3)

Table of Contents

• Requirements
• Installation
• Methods Usage
• Routes Usage
• Blades Usage
• Example
• Todo

Requirements

• This package requires PHP 5.5+
• This package requires Laravel 5.3

Installation

1. Require the package in your composer.json and update your dependency with composer update:, _(*4)

"require": {
...
"leoche/laravel-lpermissions": "1.0",
...
},

2. Add the package to your application service providers in config/app.php., _(*5)

'providers' => [
Illuminate\Validation\ValidationServiceProvider::class,
Illuminate\View\ViewServiceProvider::class,
...
Leoche\LPermissions\LPermissionsServiceProvider::class,

],

3. Publish the package migrations to your application and run these with php artisan migrate., _(*6)

$ php artisan vendor:publish --provider="Leoche\LPermissions\LPermissionsServiceProvider"

4. Add the middleware to your app/Http/Kernel.php., _(*7)

protected $routeMiddleware = [

....
'permission' => \Leoche\LPermissions\Middleware\checkPermission::class,

];

5. Add the HasRole trait to your User model., _(*8)

use Leoche\LPermissions\Traits\HasRole;

class User extends Model implements AuthenticatableContract, CanResetPasswordContract
{
use Authenticatable, HasRole;
}

Methods Usage

Roles

Creating roles, _(*9)

$role = new Role();
$role->name = 'Admin';
//The slug will be automatically generated from the role name
$role->save();

Assign or Remove a role, _(*10)

$user = User::find(1);
$user->setRole(2); // with id
//OR
$user->setRole("Admin"); // with slug/name
$user->removeRole();

Assign or remove an inherit role to a role, _(*11)

$role = Role::find(1);
$role->setInheritRole(2); //with id
//OR
$role->setInheritRole("Admin");
$role->removeInheritRole();

Assign or remove a permission to a role or a user, _(*12)

$role = Role::find(1);
$role->setPermission("admin/*", "*");
$role->removePermission("/admin/*", "*");

$user = User::find(1);
$user->setPermission("secretpage", "GET");
$user->removePermission("secretpage", "GET");


$user = User::find(1);
$user->removeAllPermissions(); //delete all permissions of user
$user->getRole->removeAllPermissions(); //delete all permissions of user's role

$role = Role::find(1);
$role->removeAllPermissions();

Notes : LPermissions parse permissions path as:, _(*13)

Routes Usage

You just have to specifythe middleware to the group route. It will check for permission and abort 401 if unauthorised, _(*14)

Route::get('/home', function () {
    return "You can go here";
});
...
Route::group(['middleware' => ['auth']], function () {
    Route::get('/home1', function () {
        return "You can go here if you're logged";
    });
});
...
Route::group(['middleware' => ['permission']], function () {
    Route::get('/home2', function () {
        return "You can go here if you or your role have '/home2' or '/*' permission";
    });
});
...
Route::group(['middleware' => ['auth','permission']], function () {
    Route::get('/home3', function () {
        return "You can go here if you're logged and you or your role have '/home3' or '/*' permission";
    });
});

Blades Usage

In your blades view you can use directives to show something (eg: links, infos) only if the user has the permission or the role, _(*15)

@permission('admin/dashboard')
 //Only shown to users who can access to admin dashboard
@endpermission
...
@permission('admin/posts','post')
 //Only shown to users who can access to admin posts with method POST
@endpermission
...

...
@role('moderator')
 //Only shown to moderators role
@endrole
...
@role('*')
 //Has any roles
@else
 //Has no role (Eg: role_id=0)
@endrole

Example

Users Table, _(*16)

Roles Table, _(*17)

Permissions Table, _(*18)

Route web.php, _(*19)

Route::get('/', function () {
    return "home ppage";
});

Route::group(['middleware' => ['auth','permission']], function () {
    Route::get('/secret', function () {
        return "SECRET PAGE";
    });
    Route::get('/account', function ($id) {
        return "view account infos";
    });
});

Route::group(["prefix" => "admin",'middleware' => ['auth','permission']], function () {
    Route::get('/', function () {
        return view('dashboard');
    });
    Route::ressource('posts', 'PostController');
});

Everyone can see the homepage, _(*20)

Only mike can view /secret, _(*21)

Lisa can do anything in /admin/* and view account pages (inherit from members), _(*22)

John can only view accounts pages, _(*23)

Todo

• [x] Function to assign/revoke role to users
• [x] Function to assign/revoke permission to role
• [x] Function to inherit role to role