Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

david2000's avatar

Login with two different roles

I have an admin which can create several recordings in the form Members.

In the table Members, there are 2 fields user_id and team_id.

Here is an example below:

enter image description here

Now, my problem is that I want to log for example with the user [email protected].

I have to see only my informations. Here is an example:

enter image description here

DataBase:

public function up()
    {
        Schema::create('users', function (Blueprint $table) {
            $table->increments('id');
            $table->string('name');
            $table->string('email')->unique();
            $table->string('password');
            $table->rememberToken();
            $table->timestamps();
        });
    }

public function up()
    {
        Schema::create('members', function (Blueprint $table) {
            $table->increments('id');
            $table->integer('user_id')->unsigned()->nullable();
            $table->foreign('user_id')->references('id')->on('users');
            $table->integer('team_id')->unsigned()->nullable();
            $table->foreign('team_id')->references('id')->on('teams');
            $table->timestamps();
        });
    }

 public function up()
        {
            Schema::create('teams', function (Blueprint $table) {
                $table->increments('id');
                $table->string('name');
                $table->integer('user_id')->unsigned()->nullable();
                $table->foreign('user_id')->references('id')->on('users');
                $table->timestamps();
            });
        }

I'm trying to understand the syntax to do?

 public function index(Request $request)
    {   
        
        $user = $request->user();
        $members = Member::query()
        ->when($user->hasRole('admin') !== true, function (Builder $query) use ($user) {
         $query->where('id???', $user->email); ????
        })
        ->when($request->has('search'), function (Builder $query) use ($request) {
        $query->where('name??', 'like', '%' . $request->input('search') . '%');
         })->with('team:id,name') 
        ->paginate(5);

        return view('admin.members.index', compact('members'))
        ->with('display_search', $user->hasRole('admin'));
   
    }

Thank you in advance for your help.

0 likes
1 reply
jlrdw's avatar

Use a scope:

https://laracasts.com/discuss/channels/laravel/security-in-controller

Don't ever look at security as two different roles, look and it like:

This method requires a role of "supervisor", just example.

Then see if one of the roles of the logged in user is "supervisor".

But logic of what a user can see is a combination of the authorization along with "what's queried" and what userid is used in the query.

In my example link, all is shown if admin, only users data if user. Note all are users, that's where the auth id plays a role in who can see and edit what.

Please or to participate in this conversation.