A way to set route in PHP Laravel application as restricted to users with permission only?

Don't want to read? Go to the bottom for the short version


I have an application built with PHP and Laravel for my company that I work for.

I also have a custom custom page permissions system that will allow my boss to set which pages the employee has access to on the page.

Group permissions were not enough, so I had to access each user at the page level.

I have a section that allows you to set permissions per user for every page. The list of pages in this section refers to the database table as some of them are outside of the application, so in this case the permission simply restricts the link to the page displayed to the user.

What I need to do is automatically detect the pages inside the Laravel app and display them in a list, so the permission can be set for the pages in the app.

I found this code Route::getRoutes()

that allows me to access all Routes in the application, but it is not enough. It is displayed below ....

Route::get('routes', function() {
$routeCollection = Route::getRoutes();

echo "<table style='width:100%'>";
    echo "<tr>";
        echo "<td width='10%'><h4>HTTP Method</h4></td>";
        echo "<td width='10%'><h4>Route</h4></td>";
        echo "<td width='80%'><h4>Corresponding Action</h4></td>";
    echo "</tr>";
    foreach ($routeCollection as $value) {
        echo "<tr>";
            echo "<td>" . $value->getMethods()[0] . "</td>";
            echo "<td>" . $value->getPath() . "</td>";
            echo "<td>" . $value->getActionName() . "</td>";
        echo "</tr>";
    }
echo "</table>";
});

      

leads to this ...

enter image description here


So using Route::getRoutes()

I will get the data shown above. I could only select routes GET

, suppose these are pages that a person can view and set permissions for, but that is not enough. I mean, some of them shouldn't be on my list of pages where permissions can be set.

I am looking for a way that can be set in my Routes where the route is defined .... set whether this page should appear on my permission page or not.

Here's an example route ...

Route::get('/timeclock/calendar', array(
    "as"   => "timeclock/calendar",
    "uses" => 'TimeClockController@showCalendar'
));

      

You can pass an array to a route, the above goes in an array with keys as

and uses

. Can I also pass my own key and then get it again when you call something like Route::getRoutes()

?

If not, any ideas on how I can determine if a route should or should not appear on my permissions page, so that I can set it to yes or no on my actual routes page, and then access that value on my permissions page so my permissions page will only show the routes i set like yes

?


My Permissions page looks like this and horizontally is a list of pages. This list of pages is what I could define to be able to show up in the list or not show everything here from the route page where I define and configure the route ...

enter image description here


A short summary version, if you don't want to read above ...

I have a permissions page in my Laravel application where I need to list all the pages / routes that exist in the application and that have an option to turn each one on or off, which will be shown or not shown in my permissions settings page.

Basically, you need to take a list of all routes available with Route::getRoutes()

, and determine from my file Routes.php

which should appear in the list of pages and should not appear in the list of pages on the permission settings page.

Any ideas how I could define this simple value yes

or no

for each route and then access that accepted value from the permissions page?

+3


source to share


1 answer


This is similar to what I'm working on right now! I am creating a template base of projects on Laravel 5.1 and using Zizaco / entrust for authorization. As @TheAlpha suggested I am using middleware to resolve any and all permission based routes. Users have Roles, Roles have permissions, and each Route assigns a permission.

It works well and is very flexible. If you want to go crazy, you can allow the user to create and delete, but not see (show) or edit. This does not mean that the site admin is configurable, but the developer can install once (per release or version), then the site admin can customize the roles as they see fit.

It's not on GitHub yet as I didn't think it was ready, but if you need that part now, I can download what I have.



Love the layout of your perms assignment btw ... I have a bunch of dropdowns that I never liked, but the checkbox matrix is ​​an interesting idea ... I can get inspired if you don't mind!

UPDATE: Here's L51ESK . YMMV! No dock, sorry right in the thick ... Stay with us. Let me know if you have any questions.

+1


source







All Articles