User Authentication and Authorization on client side with no database

@mirzashahmir02 You have writtent this.

... now i want to use @can or @role in my second app in my blade files ...

So why do you say that you can't use @can for example ?

Furthermore if you are using Spatie roles and permissions, you necessarily use models, at least the User model.

If you need to send authorization to the front end, you can for example use Laravel API Resources and add meta data with the permissions. But this will never replace any strong protection of your API routes with middlewares.

@vincent15000 I used spattie roles and permissions in my server side app all models are in my this app and authentication and authorization is working fine and second app is my frontend containing a side nav with list items how can I display the list items according with user roles or permissions in front end app. In my frontend app user data is stored in a session in an array form the array displayed above.

@mirzashahmir02 If you need to send authorization to the front end, you can for example use Laravel API Resources and add meta data with the permissions. But this will never replace any strong protection of your API routes with middlewares.

https://laravel.com/docs/9.x/eloquent-resources

@vincent15000 i want to send you some pictures to define my problem how can i post pictures here..?

@vincent15000 i am already sending the authorization to the front end bro but cant authorize the user IN THE FRONTEND listen carefully i am writing the code of both apps.

API APP LOGIN CONTROLLER:

public function login(Request $request)
    {
        $request->validate([
            'email' => 'required|email',
            'password' => 'required',
        ]);
        $credentials = $request->only('email', 'password');

        $token = Auth::attempt($credentials);
        if (!$token) {
            return response()->json(["data" => [
                'status' => 'error',
                'message' => 'Invalid Email Or Password',
            ]], 401);
        }

        $user = Auth::user();
        // $user->getPermissionNames();
        // $user->getDirectPermissions();
        $user->getPermissionsViaRoles();
        $user->getRoleNames();
        $exp = auth()->factory()->getTTL() * 60;
        return response()->json([
            "data" => [
                'status' => 'success',
                'user' => $user,
                'authorization' => [
                    'token' => $token,
                    'type' => 'bearer',
                    'expiry_time' => $exp,
                ]
            ]
        ]);
    }

IN POSTMAN i get response like this

{
    "data": {
        "status": "success",
        "user": {
            "id": 1,
            "name": "Shahmir Mirza",
            "email": "[email protected]",
            "email_verified_at": null,
            "created_at": "2022-11-21T11:22:28.000000Z",
            "updated_at": "2022-11-21T11:22:28.000000Z",
            "roles": [
                {
                    "id": 1,
                    "name": "Super Admin",
                    "guard_name": "api",
                    "created_at": null,
                    "updated_at": null,
                    "pivot": {
                        "model_id": 1,
                        "role_id": 1,
                        "model_type": "App\Models\User"
                    },
                    "permissions": []
                },
                {
                    "id": 2,
                    "name": "Admin",
                    "guard_name": "api",
                    "created_at": null,
                    "updated_at": null,
                    "pivot": {
                        "model_id": 1,
                        "role_id": 2,
                        "model_type": "App\Models\User"
                    },
                    "permissions": []
                },
                {
                    "id": 3,
                    "name": "Agent",
                    "guard_name": "api",
                    "created_at": null,
                    "updated_at": null,
                    "pivot": {
                        "model_id": 1,
                        "role_id": 3,
                        "model_type": "App\Models\User"
                    },
                    "permissions": []
                }
            ]
        },
        "authorization": {
            "token": 																																																					 
"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgwMDAvYXBpL2xvZ2luIiwiaWF0IjoxNjY5MjgyMTEwLCJleHAiOjE2NjkyODU3MTAsIm5iZiI6MTY2OTI4MjExMCwianRpIjoiTTZKTDJxRGh4RkFwSmg2NyIsInN1YiI6IjEiLCJwcnYiOiIyM2JkNWM4OTQ5ZjYwMGFkYjM5ZTcwMWM0MDA4NzJkYjdhNTk3NmY3In0.4602RIy527TW7PeEXFl9p1YlAZdpTrxEz0hMQiYpD2E",
            "type": "bearer",
            "expiry_time": 3600
        }
    }
}

then in my client side app i do the following

CLIENT SIDE APP LOGIN CONTROLLER:

public function login(Request $request)
    {
        $client = new Client();

        $request->validate([
            'email' => 'required|email',
            'password' => 'required',
        ]);

        $headers = [
            'Accept' => 'application/json',
            'Content-Type' => 'application/json',
        ];

        $credentials = [
            'email' => $request['email'],
            'password' => $request['password']
        ];

        $body = json_encode($credentials);
       // hitting an api from here
            $authRequest = new GuzzleRequest('POST', 'http://127.0.0.1:8000/api/login', $headers, $body);
           // hitting an api
            $promise = $client->sendAsync($authRequest)->then(function ($response) {
                $myResponse = json_decode($response->getBody(), true);
                return $myResponse;
            }, function ($response) {
                $myResponse = $response->getResponse()->getBody();
                $err = json_decode($myResponse, true);
                return $err;
            })->wait();

            if (isset($promise['data']['status']) == 'success') {
			// here i am putting my response in a session and redirecting it to dashboard
                Session::put('auth_user', $promise);
            } elseif (($promise['data']['status']) == 'error') {
                return $promise;
            }
        
    }

my blade file of this client app :

@extends('layouts.app')

@push('title')
    Dashboard
@endpush

@section('main_sec')

// i want to use this following code instead of if else how can i use this
@role("Super Admin")
 {{ "YOU ARE SUPER ADMIN" }}
@elserole ("Admin")
{{ "You are admin" }}                    
@endrole

// i want to use this above code instead of if else how can i use this
@endsection

@jlrdw check my latest comment bro

@mirzashahmir02 He probably invites you to read the documentation ;).

https://laravel.com/docs/9.x/passport