API Authorization multiple roles
First of all I would like to say hi, because I'm new on this forum.
I'm having difficulties understanding laravel authorization in general. I would like to know what would be clean approach to solve authorization in system described below:
I'm using laravel 10.
Building backed API meant to be used with SPA VUE 3 Frontend and mobile app.
For now I have 3 types of users (Lets say Admin, Manager and Client).
Client has very low permissions for example, client can create account, see some announcments , and edit some of account info.
Manager can add clients, view clients, edit client data ....etc
Admin is the boss so he can do everything.
I found a solution to make different route routes for let's say admin and manage: for example: /api/admin/add_client /api/manager/add_client my routes are currently same for all user types, so only /api/add_client Is this the right approach and what is the best way to do authorization based on user roles.
Also I don't have roles table because users cant have multiple roles so it seemed cleaner to only add field in user table. So do I need roles table and what are the benefits of using one except multiple user roles?
Please or to participate in this conversation.