Same permission but different routes/controllers/views
I currently have 2 user roles; Admins and Managers. They can both view an Event but need to see and do very different things. I've structured the routes as follows:
/admin/events/{id}
/manager/events/{id}
Each has their own controller and I'm using resource routes along with authorizeResource in the controllers' construct. I then have an EventPolicy where the user is required to have the permission 'Show an event' which in this case, both roles have.
The problem is, as both roles would pass the authorization, they can access each others routes/controllers.
One solution is to add role based middleware to the routes however I'd like to avoid this as there will be other roles with different permissions to be added and it would be nice to avoid having to update these checks and just rely on permissions.
Another is to prefix the permissions for a manager such as 'Manager - Show an event' but it would still have the same issue with the Policy as it would check for either permission and still permit access to either role.
It would be nice to have different versions of the EventPolicy for the route types (admin/manager) but I don't believe it's possible.
I did also consider adding all of the permissions checks directly on the routes themselves as middleware but this wouldn't allow the cleaner Route::resource in my routes files so I'd have to split out my routes individually.
I feel like I'm missing something or perhaps making it more complicated than it needs to be. Any advise would be greatly appreciated.
Please or to participate in this conversation.