Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Tasmin's avatar

Roles and Permission with the Provided AuthController

I want to implement role permission system with the built in auth system of laravel. My plan is to, create two types of roles. Admin, and Employee. Only an admin can register an employee, and an employee only can log in with his account. That is if an employee logs in then the register option wont be shown. But I can not implement my process to the built in authcontroller.

my route:

Route::auth();
Route::get('/home', 'HomeController@index');

roles table:

use Illuminate\Database\Schema\Blueprint; use Illuminate\Database\Migrations\Migration;

class CreateTableRoles extends Migration {

public function up()
{
    Schema::create('roles', function (Blueprint $table) {
        $table->increments('id');
        $table->timestamps();
        $table->string('name');
        $table->string('description');

    });
}

public function down()
{
    Schema::drop('roles');
}

}

roles_users table

use Illuminate\Database\Schema\Blueprint; use Illuminate\Database\Migrations\Migration;

class CreateTableRolesUsers extends Migration {

public function up()
{
    Schema::create('roles_users', function (Blueprint $table) {
        $table->increments('id');
        $table->timestamps();
        $table->integer('user_id');

        $table->integer('role_id');



    });
}

public function down()
{
    Schema::drop('roles_users');
}

}

RoleTableSeeder

use Illuminate\Database\Seeder;

class RoleTableSeeder extends Seeder {

public function run() {

    $role_employee= new \App\Role();
    $role_employee->name = 'Employee';
    $role_employee->description = 'An employee';
    $role_employee->save();

    $role_admin= new \App\Role();
    $role_admin->name = 'Admin';
    $role_admin->description = 'An Admin';
    $role_admin->save();

}

}

0 likes
2 replies
katifrantz's avatar
Level 6

The easiest way to do this is have a boolean field in your database called admin or something . Then, create a custom middleware , that checks if the authenticated user has admin == 1 .If true, then the user can proceed to that specified url. If no, then the user can be redirected with an Unauthenticated error. Best solution I think . Specify if you need help writing the code.

2 likes

Please or to participate in this conversation.