Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Deekshith's avatar

How to use role middleware in auth sanctum

I have a roles model,

/**
     * A user-group has one permission
     * @return \Illuminate\Database\Eloquent\Relations\HasOne
     */
    public function permission()
    {
        return $this->hasOne('App\Models\RolePermission');
    }

    /**
     * A user group has many users
     * @return \Illuminate\Database\Eloquent\Relations\HasMany
     */
    public function users()
    {
        return $this->hasMany('App\Models\User', 'role_id', 'id');
    }

RolePermission.php

/**
     * Permission table belongs to a group
     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
     */
    public function role()
    {
        return $this->belongsTo('App\Models\Role', 'role_id', 'id');
    }

User.php

/**
     * A user belongs to a user-group (e.g. Moderator)
     *
     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
     */
    public function role()
    {

        return $this->belongsTo('App\Models\Role', 'role_id', 'id');
    }

Now i have a middleware like below,

public function handle(Request $request, Closure $next)
    {

        if (Auth::user()->role->permission->can_access_admin_panel)
            return $next($request);

       abort(401, 'This action is unauthorized.');
    }

this is what i am using in normal session based authentication.

But now in another project i am using laravel sanctum for api authentication and i have routes like below,

Route::group(['middleware' => ['auth:sanctum']], function () {

	Route::get('/user-detail', function(Request $request) {
        return auth()->user();
    });

    Route::post('/auth/logout', [UserAuthController::class, 'logout']);
});

Now here i want to add another middleware where only admin with permission of can_access_admin_panel can be able to run /user-detail api otherwise it should return 401 status.

I am not getting how to add this? Any Help? Thank you

0 likes
1 reply
CorvS's avatar

@deekshith Not sure I get you, but why don't you simply add your middleware to the route?

Route::get('/user-detail', function(Request $request) {
    return auth()->user();
})->middleware('your-middleware');
1 like

Please or to participate in this conversation.