Organization Centric vs User Centric

I am guessing some have dual roles. I normally handle what a logged in users role can or cannot do:

• Bob is an admin

• Suzy is admin and does bookkeeping

• Mary is a bookkeeper only

• If Bob is logged in, Bob can only do admin stuff and all access to user stuff. But Bob cannot mess with bookkeeping.

• If Suzy is logged in she can access admin stuff and bookkeeping and accounting stuff.

• If Mary is logged in she cannot mess with admin stuff, but has access to bookkeeping and accounting stuff.

So I just check at method level if the logged in users role can or cannot access that method / function.

And use query scopes to let a user edit / view their own data or an admin can access all users data.

Each app will be different as to who can do what.

So in pseudocode:

public function makeInvoice()
    {
        if (a required role of bkeep is not true here) {   // bkeep = bookkeeper
            return redirect('somewhere'); // whereever you redirect to if not authorized
        }
        // Rest of method here is accomplished if 
        // the logged in user has the required role of 'bkeep'.
    }

Just example, Some users may have several roles.

Just another example:

public function update(Request $request, Post $post) {
    if ($post->author !== auth()->user()->id || auth()->user()->cannot('edit posts'))
        abort(404);// or redirect, or whatever action 
    }
    //rest of method if all okay
}

In a case like yours it would be a company id and and user id along with roles, this can get messy.

I would require a login per company. In a case where someone has roles in more than one company.

Your technique sounds fine.

I would do similar, (company user role) type setup. But in cases like this there is no standard correct way, rather something that works, and is secure.

I usually try to keep things simple, I like to protect at method level in the controller.

Company 5, role 3, either can or cannot do a certain method. Makes it straight forward.

Edit: prior to making a decision take a couple of good RBAC tutorials, generic, not just laravel specific.

Reading your post, I think the Laratrust package could be useful to consider. Especially because it has a Teams feature, which lets you set and check roles and/or permissions for a team/company.

@vkronlein If you have a company_user pivot table, then you could store the role for that user–company combination as a pivot column on that table if you’re not already. Then, a user can have different roles at different companies. You could then do authorisation checks based on the company and role the user has at that company.