How to implement an access level system in Laravel (Part 1)
This is my very first article on medium and I’m so excited
hope to enjoy it
Let’s assume that we want to give limited access to admins of your system,
for example, some of the admins only can see the users but some of them can only delete the users
Let’s jump right into it
create a fresh laravel project
laravel new blogSet your database connection in .env file and run the migrations
php artisan migrate && php artisan db:seedIn this project, we have User, Article models (as simple as possible)
php artisan make:model Article -aNow create a simple CRUD for Article
<?php
namespace App\Http\Controllers;
use App\Models\Article;
use Illuminate\Http\Request;
class ArticleController extends Controller
{
/**
* Display a listing of the resource.
*
* @return \Illuminate\Http\Response|string
*/
public function index()
{
return "get article list";
}
/**
* Show the form for creating a new resource.
*
* @return \Illuminate\Http\Response|string
*/
public function create()
{
return "create new article";
}
/**
* Display the specified resource.
*
* @param \App\Models\Article $article
* @return \Illuminate\Http\Response|string
*/
public function show(Article $article)
{
return "shw one article";
}
/**
* Update the specified resource in storage.
*
* @param \Illuminate\Http\Request $request
* @param \App\Models\Article $article
* @return \Illuminate\Http\Response|string
*/
public function update(Request $request, Article $article)
{
return "edit article";
}
/**
* Remove the specified resource from storage.
*
* @param \App\Models\Article $article
* @return \Illuminate\Http\Response|string
*/
public function destroy(Article $article)
{
return "delete article";
}
}Now we must implement an Authentication system
in this project I used JWT
To install JWT package just run command:
composer require tymon/jwt-authAnd you need to do some changes in your User Model
<?php
namespace App\Models;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Tymon\JWTAuth\Contracts\JWTSubject;
class User extends Authenticatable implements JWTSubject
{
use HasFactory, Notifiable;
// Rest omitted for brevity
/**
* Get the identifier that will be stored in the subject claim of the JWT.
*
* @return mixed
*/
public function getJWTIdentifier()
{
return $this->getKey();
}
/**
* Return a key value array, containing any custom claims to be added to the JWT.
*
* @return array
*/
public function getJWTCustomClaims()
{
return [];
}
/**
* The attributes that are mass assignable.
*
* @var array
*/
protected $fillable = [
'name',
'email',
'password',
];
/**
* The attributes that should be hidden for arrays.
*
* @var array
*/
protected $hidden = [
'password',
'remember_token',
];
/**
* The attributes that should be cast to native types.
*
* @var array
*/
protected $casts = [
'email_verified_at' => 'datetime',
];
}Let’s make some APIs for login and logout and get the logged-in user
The AuthController should look like this :
<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
class AuthController extends Controller
{
/**
* Create a new AuthController instance.
*
* @return void
*/
public function __construct()
{
$this->middleware('auth:api', ['except' => ['login']]);
}
/**
* Get a JWT via given credentials.
*
* @return \Illuminate\Http\JsonResponse
*/
public function login()
{
$credentials = request(['email', 'password']);
if (! $token = auth()->attempt($credentials)) {
return response()->json(['error' => 'Unauthorized'], 401);
}
return $this->respondWithToken($token);
}
/**
* Get the authenticated User.
*
* @return \Illuminate\Http\JsonResponse
*/
public function me()
{
return response()->json(auth()->user());
}
/**
* Get the token array structure.
*
* @param string $token
*
* @return \Illuminate\Http\JsonResponse
*/
protected function respondWithToken(string $token): \Illuminate\Http\JsonResponse
{
return response()->json([
'access_token' => $token,
'token_type' => 'bearer',
'expires_in' => auth()->factory()->getTTL() * 60
]);
}
}So let’s define APIs endpoint in routes/api.php
<?php
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
/*
|--------------------------------------------------------------------------
| API Routes
|--------------------------------------------------------------------------
|
| Here is where you can register API routes for your application. These
| routes are loaded by the RouteServiceProvider within a group which
| is assigned the "api" middleware group. Enjoy building your API!
|
*/
Route::group([
'prefix' => 'auth'
], function () {
Route::post('login', [\App\Http\Controllers\AuthController::class , 'login']);
Route::post('me', [\App\Http\Controllers\AuthController::class , 'me']);
});Now you can log in and receive the token
Spatie package
In this project, I used the Laravel-permission package
Installation
composer require spatie/laravel-permissionYou should publish the migration and the config/permission.php config file with:
php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"Run the migrations: After the config and migration have been published and configured, you can create the tables for this package by running:
php artisan migrateIn Your User Model add Spatie\Permission\Traits\HasRoles trait
use Spatie\Permission\Traits\HasRoles;class User extends Authenticatable implements JWTSubject
{
use HasFactory, Notifiable , HasRoles;
protected $guard_name = 'api';
....
After this, we should create a controller for access levels
php artisan make:controller AccessLevelControllerIn your system, you may have many roles such as admin, super admin, accountant, …
because of that, you should have a method to add new roles
In AccessLevelController class add “createRole” method
<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Spatie\Permission\Models\Role;
class AccessLevelController extends Controller
{
public function createRole(Request $request): \Illuminate\Http\JsonResponse
{
$role = Role::create(['name' => $request->name]);
return response()->json($role);
}
}But we have constant permissions like “View Articles”, “show Articles”, “Create Articles”, “Update Articles”, “Delete Articles”
Byword constant I mean we must have a policy that cannot be changed
to make this happen make a PHP file called access_level.php in /configdirectory
<?php
return [
'Articles' => [
'View Articles',
'Show Articles',
'Update Articles',
'Create Articles',
'Delete Articles'
]
];Add a method to create permissions in the database
<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;
class AccessLevelController extends Controller
{
public function createRole(Request $request): \Illuminate\Http\JsonResponse
{
$role = Role::create(['name' => $request->name]);
return response()->json($role);
}
public function createPermission()
{
DB::beginTransaction();
try {
$config = config('access_level');
$permissions = [];
foreach ($config as $permission) {
foreach ($permission as $item) {
$permissions[] = $item;
}
}
foreach ($permissions as $permission_name)
{
if (DB::table('permissions')->where('name' , $permission_name)->count() == 0)
{
Permission::query()->create(['name' => $permission_name]);
}
}
DB::commit();
return 'done';
} catch (\Exception $exception) {
DB::rollBack();
return response([
'error' => $exception->getMessage()
]);
}
}
}Now it is time to assign permissions to a role
add another method to AccessLevelController called assignPermission
public function assignPermission(Role $role, Request $request)
{
$this->validate($request , [
'permission_ids' => 'required|array',
'permission_ids.*' => 'required|exists:permissions,id'
]);
$permissions = Permission::query()->whereIn('id', $request->get('permission_ids'))->get();
$role->syncPermissions($permissions);
return response('permissions were assigned to ' . $role->name . ' role successfully');
}Finally, give the role to users with “giveRoleToUsers” method
public function giveRoleToUsers(Role $role, Request $request)
{
$this->validate($request, [
'user_ids' => 'required|array',
'user_ids.*' => 'required|exists:users,id',
]);
User::query()->whereIn('id', $request->get('user_ids'))->get()->each(function ($user) use ($role) {
$user->assignRole($role->name);
});
return response($role->name . ' role was assigned to users');
}create some role and permission then give the role to a user (via postman)
