Laravel Authorization

Laravel-authz is an authorization library for the laravel framework.

It's based on Casbin, an authorization library that supports access control models like ACL, RBAC, ABAC.

All you need to learn to use Casbin first.

• Installation
• Usage
  • Quick start
  • Using Enforcer Api
  • Using a middleware
  • basic Enforcer Middleware
  • HTTP Request Middleware ( RESTful is also supported )
  • Using Gates
  • Multiple enforcers
  • Using artisan commands
  • Cache
• Thinks
• License

Installation

Require this package in the composer.json of your Laravel project. This will download the package.

The Lauthz\LauthzServiceProvider is auto-discovered and registered by default, but if you want to register it yourself:

Add the ServiceProvider in config/app.php

The Enforcer facade is also auto-discovered, but if you want to add it manually:

Add the Facade in config/app.php

To publish the config, run the vendor publish command:

This will create a new model config file named config/lauthz-rbac-model.conf and a new lauthz config file named config/lauthz.php.

To migrate the migrations, run the migrate command:

This will create a new table named rules

Usage

Quick start

Once installed you can do stuff like this:

You can check if a user has a permission like this:

Using Enforcer Api

It provides a very rich api to facilitate various operations on the Policy:

Gets all roles:

Gets all the authorization rules in the policy.:

Gets the roles that a user has.

Gets the users that has a role.

Determines whether a user has a role.

Adds a role for a user.

Adds a permission for a user or role.

Deletes a role for a user.

Deletes all roles for a user.

Deletes a role.

Deletes a permission.

Deletes a permission for a user or role.

Deletes permissions for a user or role.

Gets permissions for a user or role.

Determines whether a user has a permission.

See Casbin API for more APIs.

Using a middleware

This package comes with EnforcerMiddleware, RequestMiddleware middlewares. You can add them inside your app/Http/Kernel.php file.

basic Enforcer Middleware

Then you can protect your routes using middleware rules:

HTTP Request Middleware ( RESTful is also supported )

If you need to authorize a Request，you need to define the model configuration first in config/lauthz-rbac-model.conf:

Then, using middleware rules:

Using Gates

You can use Laravel Gates to check if a user has a permission, provided that you have set an existing user instance as the currently authenticated user.

If you require custom Laravel Gates, you can disable the automatic registration by setting enabled_register_at_gates to false in the lauthz file. After that, you can use Gates::before or Gates::after in your ServiceProvider to register custom Gates. See Gates for more details.

Multiple enforcers

If you need multiple permission controls in your project, you can configure multiple enforcers.

In the lauthz file, it should be like this:

Then you can choose which enforcers to use.

Using artisan commands

You can create a policy from a console with artisan commands.

To user:

To Role:

Adds a role for a user:

Using cache

Authorization rules are cached to speed up performance. The default is off.

Sets your own cache configs in Laravel's config/lauthz.php.

Thinks

Casbin in Laravel. You can find the full documentation of Casbin on the website.

License

This project is licensed under the Apache 2.0 license.