用户角色 - 使用Gate还是不使用？

Question

I need to implement simple User Role such as Admin, Moderator, and Analytics.

I don't need to add permission/features on each role. A user can be assigned to 1 role only.

There might be many way to implement this in Laravel, I am looking decent way implementing this and secure.

Would Gate facade be right approach for this? Or create a Role model with methods. Something like: if ($user->hasRole(['admin', 'moderator'])) { //can view this feature } in blade or controller. There might be a cleaner way than this and role check in middleware.

Answer 1

Regardless of whether you use Middleware, Request authorize method, Policies or Gates (which can be used as a Middleware), you would still need Role model.

Roles table will be the place you store all the roles and attach them to users by their name or slugs.

1. Create a Role model.

   • Id
   • Name

2. If you're sure, that a user can only have 1 Role, then add role_id to your users table.

3. Add the relationships inside the User and Role models.

User.php

public function role()
{
    return $this->hasOne(Role::class);
}

Role.php

public function user()
{
     return $this->belongsTo(User::class);
}

4. In your AuthServiceProvider.php, you can define the gates:

(assuming role_id is not nullable)

Gate::define('do-this', function ($user) {
    return in_array($user->role->name, DoThisClass::allowedRoles());
});

1. In your blades, you can check if the user has permission for certain tasks using @can directives.:

   @can('do-this')
       <button>You can definitely do this!</button>
   @endcan
   

2. In your Routes, you can check if user is authorized by using Gates as a Middleware:

   Route::group(['middleware' => ['can:do-this']], function () {
       Route::get('do-this', 'DoThisController@action');
   });
   

Why should you tie Gates with names rather than ID of Roles?

Since Roles can be deleted and it's super unreadable to use their ID, I would recommend using Role names.

The IDs can mismatch in the code and the databases when different enviroments are used.