• Every role can login and use system?
• Every role has different UI/features?

Authentication just means someone is logged in. You need authorization to to determine what a logged in user can or cannot do.

I suggest you also look at Spatie: https://github.com/spatie/laravel-permission

If you are familiar with RBAC already you could also custom code authorization, but custom is for highly experienced programmers only. https://gist.github.com/jimgwhit/ed44a6c81815804f1ab910ce9eb88d84

// Bob has roles assigned admin and doctor 
// A method in controller Bob wants to access
// This method (function) requires the role to be doctor
// YOU NEED TO PROGRAM IN   (However you need to)

// Is doctor one of Bobs roles.

if doctor is not one of Bobs stored roles
    redirect where ever

rest of method since access is allowed

And use scopes to fine tune a query for a user seeing their own data.

Learn how to work with the

Auth::user()->id;

It is the key (main thing) to use to ensure a user is seing their own data. It has to match the FK in another table.

Like when building a query scope:

            $userid = Auth::user()->id;
            $query->where('ownerid', '=', $userid);

A spatie exampe:

spatie example:
public function update(Request $request, Post $post) {
    if ($post->author !== auth()->user()->id || auth()->user()->cannot('edit posts'))
        abort(404);// or some other 
    }
}

So no matter the RBAC, learn all about that auth()->user()->id.

Note

There is a fairly large learning curve with authorization, even Jeffrey in a video says it tricky at first but gets easier as you learn it.

@jlrdw why use that package when he has Policies out of the box which have more readable syntax than that package?

Also I think he is more asking about code and database architecture than which specific implementation to use for permissions.

Ofc, I might be wrong :D

What I do is I have column in users for roles. I assign a single letter like a for admin, u for user, etc. Then I use the Auth facade to pull the user information and I use logic like:

If user_role == a

then the user can see this

else

the user sees this

it works in my use case. I'm going to start implementing this in routes/web.php.

I don't think this rig would work in a large scale operation.

@bugsysha I only said "I suggest you also look at Spatie", as an option, what @kiasaty uses is their choice. I was just showing other options that a lot of folks here also mention.

@jlrdw my question was not well formed. I'm asking is there something special that package provides compared to builtin option?

@bugsysha I know higher level members like snapey has recommended it. https://laracasts.com/discuss/channels/laravel/roles-and-permissions-2

I have my own custom authorization. So I don't use it, but I have looked it over in detail and it seems to me easier than in built. But just my opinion.

I use other Frameworks as well so I don't write framework biased authorization I use authorization that works in other languages and Frameworks as well.

However I would never recommend to a newcomer to programming to attempt their own until they have learned it very well first.

Custom authorization is more for someone who's been programming quite a while and fully understands how to protect data.

See my gist it's just some simple examples but of course I have a lot more methods than that, it was just meant for simple examples only.

Thank you for answering,

but I don't have any problem with authorization.

Actually I'm asking about database design when different user roles have their own specific attributes.

When users share the same attributes, I create a user table with a "role_id" column.

But what about when some user roles also have their own additional attributes?

Username and password are shared attributes and I'm putting them in the user table. So there is no problem in authenticating or authorizing users.

I'm looking for the best database and system design to handle role specific attributes.

one approach is to create sub tables like doctor_user, secretary_user, patient_user for additional attributes. but I don't know if this fits good in Eloquent.

@jlrdw @bugsysha

Most folks in that case would setup a related roles table. Many past answers on roles and permissions and how others have set it up, if you copy and paste this in google, you will get several past articles on it:

site:laracasts.com roles and permissions setup

@kiasaty do the following:

• if all doctors have same attributes then either put it in some separate table or config file
• if all doctors have different attributes put it in json column on users table which you can call features, options, settings, or who knows how.

Also for the example from your initial post doctor: secretary_id, specialty it is possible to create polymorphic table which accepts those different models and relates them to the doctor. User with role doctor has many of those.

Apply all above to every role you have and that is it.

hello, did you solve the problem? because i am facing the same problem but i only have a doctor and an patient. when i read the comments below your question i did not quite find the answer. if you ever did find a solution it would be nice to share it.

That sounds like a pretty overcomplicated solution that will probably produce bunch of issues at larger scale and once requirements complexity rises.

@bugsysha which solution? Postgres table inheritance or eloquent polymorphic relationship?

what do you think is the best way to tackle this challenge? because I'm exactly looking for a solution which can survive the rise of requirements complexity.

In my mind proposed A and B are both overcomplicated solutions. Easiest one is single responsibility principle translated to database means to have a single column to describe the type of the user on the users table.

@bugsysha But where should the doctor specific column and patient specific column be stored?

doctors have a column named "specialty", and patients have a column named "medical_number". this is an example, they could have more particular columns.

it is not a good idea to put the "specialty" and "medical_number" columns in users table and leave "specialty" column for patients null and vice-versa.

It is not a good idea either to create two tables named "doctors" and "patients" and repeat all the shared columns in them.

So what is the solution?

Thank you so much

@kiasaty if your data is totally different for different types of users then I would go with JSON profile column on users table and use custom casts.

https://laravel.com/docs/7.x/eloquent-mutators#custom-casts

The reason why I would use custom casts over something like what @snapey provided is that I have a feeling that you will never start a query from your doctors or patients table and it is easier if you have all the data inside one table.

Also the queries are simpler since you will not have to provide a callback to see the content of related table, instead you would use whereJsonContains.