Download the PHP package coyote6/laravel-permissions without Composer

Laravel Permissions

A package for managing permissions and user roles.

To use

1. Install require coyote6/laravel-permissions
2. Optional: publish config file if you wish to change database table names.

Default below:

3. Run migrations (and seed if you want the default values)

Or

Or

4. Add traits to the User model.

5. Add traits to all needed policies.

6. Add admin role to your admin user(s) via code:

(Working on a better method)

7. Once your admin user has the administrator role you and if using the coyote6/laravel-crud package, go to the '/admin/users' on your site and manage any additional roles from there.

8. To create permissions and roles, and add permissions to roles you can use the following code example:

Or if using the coyote6/laravel-crud package, go to the a '/admin/users/permissions' and '/admin/users/roles' respectively on the site.

9. Optional: Add permission code to policies and/or use Policy Traits (see Policy Traits below):

10. Optional: Add permission code as needed to templates via blade directives.

Blade Directives

User Can - Permission Id(s)

User Is - User Id(s)

User Is and Can - User Id(s) and Permission Id(s)

Author Or Can - User Id(s) and Has Permission or Has Other Permission

Policy Traits

You can now use the StandardPolicy, StandardAuthorPolicy, StandardClientPolicy, and StandardAuthorOrClientPolicy to make short work out of writing policies for your models.

The policy traits follow a standard method for using permission names to check a user's permissions. The permission names for the StandardPolicy should follow this convention with the [PLURAL_MODELNAME] being replaced by lower cased plural form of your model. administer[PLURAL_MODELNAME] create[PLURAL_MODELNAME] update[PLURAL_MODELNAME] delete[PLURAL_MODELNAME] view[PLURAL_MODELNAME] search[PLURAL_MODEL_NAME]

The StandardAuthorPolicy expands on the StandardPolicy and allows the user to always access their own model permissions.

The StandardClientPolicy expands on the StandardPolicy but also adds the following permissions and checks if the user's client id matches that of the model's: administerclient[PLURAL_MODEL_NAME] updateclient[PLURAL_MODEL_NAME] deleteclient[PLURAL_MODEL_NAME] viewclient[PLURAL_MODEL_NAME] searchclient[PLURAL_MODEL_NAME]

The StandardAuthorOrClientPolicy combines the StandardAuthorPolicy with the StandardClient Policy allowing a user permission to access the model if they are the owner or it is owned by their client.

Using Policy Traits

To use these Policy traits, you attach the trait to your policy and write the name of the permission in the $modelPermissionName property. This will be the same [PLURAL_MODEL_NAME] you used when writing your permissions.

When the policy calls one of these 6 actions using the authorize() method, it generates a check on the permission for the action using one of those 6 permissions on the model. So if the $modelPermissionName property is set to 'models' when authorize() method has its action set, these are the permission names it checks:

Optional Parameters

Model Type Check ($autoDetectPolicy & $modelClass) - All Policy Traits

The StandardPolicy trait has two additional parameters that allow you to check if the provided model in the authorize() method matches what is expected in the policy. These are unnecessary if you are using Laravel's autodetect policy, but may be a good idea to turn one if manually mapping policies, but definitely not required. They are here just to prevent accidentally mapping the wrong policy to a model and helps prevent possible security bugs by allowing the incorrect permissions.

The first step is setting the autodetect on the policy to false.

Any other value besides false, will result in $this->autoDetectPolicy reverting to the default of true, and no longer checking the model.

The next is to set the policy's $modelClass property. This should be the full namespace and class name of the model being checked.

or

Model Owner ($modelOwnerProperty) - StandardAuthorPolicy & StandandAuthorOrClientPolicy

The model owner property allows you to change the owner of a model, if you use something besides the default of author_id, to relate to the $user->id.

Examples:

Model Client ($modelClientProperty) - StandardClientPolicy & StandandAuthorOrClientPolicy

The client owner property allows you to change the client id of a model, if you use something besides the default of client_id, to relate to the $user->client_id.

Examples:

Overriding Permission Names

If you need to change the default permission prefixes, you can do so using their property names as follows:

Or you can override their getter methods:

Example:

This will change the permission that is being checked from 'update_models' to 'edit_models'.