I'm trying to add Authorization Policies to my project but I'm unsure how to recreate this logic. I have multiple user types (roles) such as:
- SuperAdmin
- Admin
- Director
- Profesor
- Student
The SuperAdmin can do everything and see everything, the Admin can do almost anything and see what they created and the Director is limited to what they can do and see.
The Profesor and Student can't do anything except answer surveys or forums.
Right now I'm going to use as an example a Survey Section. These can be created, updated, deleted and can be seen by the SuperAdmin and the Admin can create, see all, but can only update and delete the Sections they created. The Director can only see them but can't create, update or delete them.
I created the Policy and this is what I have right now
class SectionPolicy
{
use HandlesAuthorization;
/**
* Determine whether the user can create survey sections.
*
* @param \App\Models\User $user
* @return mixed
*/
public function create(User $user)
{
return $user->isSuperAdmin() || $user->isAdmin();
}
/**
* Determine whether the user can update the survey section.
*
* @param \App\Models\User $user
* @param \App\SurveySection $surveySection
* @return mixed
*/
public function update(User $user, SurveySection $surveySection)
{
//
}
/**
* Determine whether the user can delete the survey section.
*
* @param \App\Models\User $user
* @param \App\SurveySection $surveySection
* @return mixed
*/
public function delete(User $user, SurveySection $surveySection)
{
//
}
}
In my User Model I have these methods, the user can have multiple types, for example a user can be a profesor and a teacher at the same time, or a director and a teacher at the same time. The getUserTypeHighest is useful because it returns the highest authority user type the user has, so a director and teacher user will return highest user type as Director which has the most privileges.
public function hasUserType($id = [])
{
if (!is_array($id)) {
$id = [$id];
}
return $this->userType()
->whereIn('id', $id)
->count() > 0;
}
public function getUserTypeHighest()
{
$types = $this->userType;
$t = [];
foreach ($types as $type) {
$t[] = $type->pivot->user_type_id;
}
return min($t);
}
public function getUserTypes()
{
$types = $this->userType;
$t = [];
foreach ($types as $type) {
$t[] = $type->pivot->user_type_id;
}
return $t;
}
public function isSuperAdmin()
{
return $this->hasUserType(UserType::SUPER_ADMIN);
}
public function isAdmin()
{
return $this->hasUserType(UserType::ADMIN);
}
public function isDirector()
{
return $this->hasUserType(UserType::DIRECTOR);
}
public function isProfesor()
{
return $this->hasUserType(UserType::PROFESOR);
}
public function isStudent()
{
return $this->hasUserType(UserType::STUDENT);
}
When trying to create a new Survey Section I get a 403 when logged in as a SuperAdmin
public function store(SaveSectionRequest $request)
{
$this->authorize('create');
DB::beginTransaction();
$section = new SurveySection();
$section->title = $request->title;
$section->description = $request->description;
$section->user_id = $request->user()->id;
$section->save();
DB::commit();
return back();
}
How can I recreate this logic in my policy?