Download the PHP package kordy/auzo without Composer

Central management of Laravel authorization with database and user roles for Laravel 5.1, 5.2, and 5.3.

Ever thought about a way to put a policy or condition on every permission as a restriction, something like: allow authenticated user to modify posts Only if he is the post author or Only if he is in the same group as the author or Only if the post is not published ... etc

Not like other roles based packages, this package fills this gap by restricting user's role permission with a condition/policy, as it follows Attribute-Based Access Controll (ABAC) approach as Laravel authorize does.

Database tables will be installed to store abilities, user roles, permissions, and custom condition/policy per each permission you give.

AuzoTools package is required and will be installed, it provides several great tools that facilitates Laravel authorize management.

What you can do with this package:

1. Manage Abilities
2. Manage Roles
3. Manage Conditions/Policies
4. Manage Permissions
5. Generate abilities

Installation

You can install the package via composer:

This service provider must be installed.

You can publish the migrations with:

After the migration has been published you can create the role- and permission-tables by running the migrations:

You can publish the config file with:

Finally, you have to add the HasRoleTrait trait to the user's model where you want to assign roles to them.

Customization

You can replace or extend any model of the package through the configuration file, create your own class, use the model trait, modify any function, and just add the new class path in the config/auzo.php file.

config/auzo.php contents:

Usage

Abilities

By default Laravel authorize abilities are defined statically through the service provider, this package gives more flexibility by creating them in the database and automatically defines them.

Manage abilities using AuzoAbility Facade:

Manage abilities using auzo:ability artisan command:

Roles

Auzo approaches Role Based Access Control (RBAC) methodology, All users get their permissions "only" through their role, that is for better usability and scalability, and to maintain solid and non-conflict polices from different roles, "only" single role is allowed per user.

Manage roles using AuzoRole Facade:

Manage roles using auzo:role artisan command:

Assign role to a user using hasRole trait relationship:

Manage user role assignment using auzo:user artisan command:

Policies

You can define custom conditions or as we name it here "policies", policy is a custom function (that you have created somewhere) which defines some conditions that have to be met before granting the permission to a user.

example: grant a user permission if the user is the owner of the post.

see src/Services/AccessPolicies.php for more examples.

Manage policies through AuzoPolicy Facade:

Manage policies using auzo:policy artisan command:

Permissions

Give role a permission to an ability:

Give role a permission to an ability restricted by policy:

Using auzo:permission artisan command to manage permissions:

if multiple policies applied, a default "AND" is applied between policies, unless you specified an operator at the time of adding policies to the permission.

Generate abilities

This will use GenerateAbilities from AuzoTools to generate all abilities (by default matching route source scheme) for a model and its fields, and saves them to the database abilities table.

Through the GeneratAbilitiesToDB class:

Through the artisan command

This will generate and save all abilities below to abilities table:

Credits

1. Based on laravel-permission package which is considered the best alternative for this package if you need multiple roles and direct permissions for users.
2. A lot of help from my friend balping

Contributing

Please see CONTRIBUTING for details.

License

The MIT License (MIT). Please see License File for more information.