Role-Permission relationship problem

Nope, it is not possible working with Laravel Eloquent that way. That error is spot on.

With Dynamic Relationships and Eloquent Collections we can do this:

    public function create(User $user)
    {
		$permissions = $user
            ->roles
            ->map(fn (Role $role) => $role->permissions)
            ->collapse()
            ->unique();

        return $permissions->contains('name', 'create-post');
    }

Or we can do everything in one go, with a bit of higher order messages

    public function create(User $user)
    {
		return $user
            ->roles
            ->map
            ->permissions
            ->collapse()
            ->unique()
            ->contains('name', 'create-post');
    }

Let me know if those work.

Apparently you are using your own system of authorization. You might have heard about Bouncer and Spatie permissions. Those could make features like this more streamlined.

Why would users have multiple roles? That just seems to make things way more complicated than the they need to be. You are over engineering a pretty simple thing.

Mutiple roles are used at times.

Example I've used in the past.

• Bob is an admin

• Suzy is admin and does bookkeeping

• Mary is a bookkeeper only

• If Bob is logged in, Bob can only do admin stuff and all access to user stuff. But Bob cannot mess with bookkeeping.

• If Suzy is logged in she can access admin stuff and bookkeeping and accounting stuff.

• If Mary is logged in she cannot mess with admin stuff, but has access to bookkeeping and accounting stuff.

So I just check at method level if the logged in users role can or cannot access that method / function.

And use query scopes to let a user edit / view their own data or an admin can access all users data.

Each app will be different as to who can do what.

So in pseudocode:

public function makeInvoice()
    {
        if (a required role of bkeep is not true here) {   // bkeep = bookkeeper
            return redirect('somewhere'); // whereever you redirect to if not authorized
        }
        // Rest of method here is accomplished if 
        // the logged in user has the required role of 'bkeep'.
    }

Again just examples.

Also a Spatie example I saw:

public function update(Request $request, Post $post) {
    if ($post->author !== auth()->user()->id || auth()->user()->cannot('edit posts'))
        abort(404);// or redirect, or whatever action 
    }
    //rest of method if all okay
}

In summary RBAC is at least 3 main steps:

• A login required
• An authorization implementation to determine what the logged in person with role can or cannot do
• Protection of URL and parameters, checking that the logged in users id matches the id used in a query

Your main concern is:

• Okay a user is logged in (Authenticated)
• But what can they do or not do
• A method or route to a method has a lock (just example)
• If their role is the key they can enter

So there are times when a user has multiple roles like in my example, but concern yourself about the method.

• Does one of their roles allow entry, yes or no.

@martinbean also has an article on roles:

https://laracasts.com/discuss/channels/laravel/laravel-role-based-authentication-system?page=1&replyId=930281

Me I like protecting (authorize) at method level.

I see if a role matches a required role to "enter a method" like:

    public static function chkRole($role = null)
    {
        $userrole = Auth::user()->role;
        $checkrole = explode(',', $userrole);
        if (in_array($role, $checkrole)) {
            return true;
        }
        return false;
    }

From a helper class.

I use laravels authentication (login required), but I use my custom authorization.

I do not recommend custom to anyone unless they have a lot of experience however.