Roles & permissions
- Roles are stored in database so you can easy to create many roles if you want.
- Permissions are codebase, it's defined in configuration.
You can see example about permissions configuration in core/acl/config/permissions.php.
return [
[
'name' => 'Users',
'flag' => 'users.list',
'parent_flag' => 'core.system',
],
[
'name' => 'Create',
'flag' => 'users.create',
'parent_flag' => 'users.list',
],
...
];How to add your permissions flags?
- You can config it from your plugin, after plugin generated, you can find
plugins/your-plugin/config/permissions.phpand change its content.
Example:
return [
[
'name' => 'Tests',
'flag' => 'test.list',
],
[
'name' => 'Edit',
'flag' => 'test.edit',
'parent_flag' => 'test.list',
],
...
];List permissions are stored in config file. So when you change it, you need to run the artisan command cms:user:rebuild-permissions to update it into database again.
How to use it?
Example: core/acl/routes/web.php:27
Route::group(['prefix' => config('core.base.general.admin_dir'), 'middleware' => 'auth'], function () {
Route::group(['prefix' => 'system/users'], function () {
Route::get('/', [
'as' => 'users.list', // it will check permission with flag is users.list
'uses' => 'UserController@getList',
]);
Route::get('/delete/{id}', [
'as' => 'users.delete',
'uses' => 'UserController@getDelete',
'permission' => false, // No check permission
]);
Route::get('/delete/{id}', [
'as' => 'users.delete',
'uses' => 'UserController@getDelete',
'permission' => 'users.edit', // Change default permission flag to check from users.delete to users.edit
]);
Route::get('/delete/{id}', [
'as' => 'users.delete',
'uses' => 'UserController@getDelete',
'permission' => 'superuser', // Just super user can do this
]);
]);
});You can see logic to check permission here: core/acl/src/Http/Middleware/Authenticate.php:24
$route = $request->route()->getAction();
$flag = array_get($route, 'permission', array_get($route, 'as'));
$user = Auth::user();
if ($flag && !$user->hasPermission($flag)) {
if ($request->expectsJson()) {
return response()->json(['message' => 'Unauthenticated.'], 401);
}
abort(401);
}By default, it will use route name as permission flag to check. If you set permission in a route, it'll use this value to check. If permission is set to false, system will not check permission when a user access this route. If permission is set to superuser, just super user can access this route.
Available methods
hasPermission()
How to use: $user->hasPermisison('posts.edit') or \Auth::user()->hasPermisison('posts.edit')
Example:
@if (Auth::user()->hasPermisison('posts.edit'))
// Show something here
@else
// You don't have permission to edit a post
@endifhasAnyPermissions()
It's same with hasPermission but you can pass an array permissions to check. It will return true it has any permission in a list.
Example:
@if (Auth::user()->hasAnyPermisisons(['posts.edit', 'posts.delete']))
// Show something here
@else
// You don't have permission to edit a post
@endif