Use session from middleware in AppServiceProvider

@JussiMannisto I use a gate in my AppSeerviceProvider. Like this:

Gate::define('manage_invoice', function (User $user){
            return $user->manage_invoice == 1;
        });

But a user can belongToMany teams through tables users, teams and team_user

So I now have to check $user->team_user->manage_invoice in the Gate instead, so I was trying to load the user's roles in a session that I create in a middleware named GetUser

Solved. I moved the session call into each Gate. Like this:

Gate::define('manage_invoice', function (User $user){
            $u = Session::get('u');
            return in_array('manage_invoice', $u['roles']);
        });

Inside the Gate, the session seems to be available.

@muuucho That doesn't sound like something that should go in the session data. I'd just use Eloquent like you showed. What's your reasoning for storing it in session?

@JussiMannisto The reason is that I like to reduce the number of Querys that runa on each request. In the navbar I echo out $user->name and $user->team->name In controllers I need $user->userTeam->isAdmin And as mentioned I use it in AppServiceProvider. So, I try to reduce all these queries to a single one so I run it as early as possible in a middleware and store the result in a session that is available throughout all the following files is called in the request. Does it make sense?

<?php

namespace App\Http\Middleware;

use App\Models\User;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Session;
use Symfony\Component\HttpFoundation\Response;

class GetUser
{
    /**
     * Handle an incoming request.
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     */
    public function handle(Request $request, Closure $next): Response
    {
        $u=[];
        if (Auth::check()) {
            $user = User::with('currentTeamUser.roles')
                ->findOrFail(Auth::user()->id);
            // Create a "flat" array
            $u['id'] = $user->id;
            $u['name'] = $user->currentTeamUser->name;
            $u['initials'] = $user->currentTeamUser->initials;
            $u['email'] = $user->email;
            $u['teamId'] = $user->currentTeamUser->team->id;
            $u['teamUserId'] = $user->currentTeamUser->id;
            $u['teamName'] = $user->currentTeamUser->team->name;
            $u['isAdmin'] = $user->currentTeamUser->is_admin;
            $u['isActive'] = $user->currentTeamUser->is_admin;
            $u['model'] = $user->module;
            $u['roles'] = [];
            foreach ($user->currentTeamUser->roles as $role) {
                $u['roles'][] = $role->name;
            }
        }
        Session::put('u', $u);
        return $next($request);
    }
}

@muuucho That's an attempt at micro-optimization. Also, it's worse for performance. You're adding a middleware, making more DB queries and writing more data to the session store.

Let's compare two approaches to accessing $user->currentTeamUser->name in your code:

1. You call $user->currentTeamUser->name.
2. You use your approach with an additional middleware and session reads/writes.

How many DB queries does the first approach cause:

The auth middleware pulls the user model from the DB (1). The model is injected into the service container and passed around the framework during the request, including gate checks. When $user->currentTeamUser->name is called for the first time, the currentTeamUser relation is retrieved (2) and stored on the user model. All subsequent calls to $user->currentTeamUser will return it without additional DB queries.

Now your approach:

The auth middleware pulls the user model from the DB (1). Your middleware retrieves the user model again (2). As per the with() clause, the currentTeamUser relation is eager loaded (3).

That's already more DB queries per request. You're also reading and writing more data to the session store. Relationships are not loaded on the user model that is passed around the framework. Your gates won't work in commands, jobs or API routes.

In short, you should just use $user->currentTeamUser. Eager loading is also pointless here as it results in the same number of DB queries.

@JussiMannisto Thanks, that makes sense. Could it be an alternative to call a UserService.php that has a method that returns the $u whenever I need currentTeam and/or the roles that the user has in that team?

@muuucho I'd just use the user model and its relations. Eloquent is already designed to eliminate unnecessary queries.

@martinbean Not sure I understand. From where do I get the team (or, in my case team_user) data and how do I accept it in the Gates?

From where do I get the team

@muuucho Only you can answer that. We have no idea how your application is architected or modelled.

how do I accept it in the Gates?

By passing the team when you’re calling a gate method or performing an authorisation check (as per the docs I linked you to):

Gate::authorize('manage_invoice', [$currentTeam]);

@martinbean OK, thanks.

@martinbean I get how I can send additional data to Gates from controllers:

$user = User::with('currentUserTeam')->find($id);
if (! Gate::allows('manage-invoice', $user)) {
            abort(403);
        }

But how do I use That gate to restrict routes in Routes file? How do I send $user? ->middleware('can:manage_upload')

@Snapey "Decorate Auth:user()" You mean by creating an accessor in User Model for each element I would like to add?

I tried $userRoles = Auth::user()->currentTeamUser->roles->pluck('name', 'id')->toArray(); It works! I didn't know I could chain methods to Auth

@muuucho its just a pointer to a User model (in most cases) so you can call methods on it

@Snapey Yes. I wish it was pointed out more clearly in the docs or like in Laravel in 30 days. Or elsewhere. Untill today I thougt that Auth() was for auth stuff only.

@muuucho It's the first thing in the authentication docs after installing instructions. https://laravel.com/docs/11.x/authentication#retrieving-the-authenticated-user

@JussiMannisto It sure is. However, when I read that part of the docs, I was a complete newbie and didn't understood that I could chain other relational tables. And after that, I have just looked upon Auth() as a way to authenticate by users id, or use other columns from table users.

And still, from what I can remember, I haven't seen any Laravel tutorial using Auth::user()->someUserMethod Anyways, now I have implemented it in my app.

@robertogallea thanks, but not a good idea in my case.