User roles and routes access management

Hi everyone, so, I have a bunch of users that have different user account status (not activated, activated, disabled) and user roles (admin, regular user, junior etc.) Each one of them should have different stuff available to them: different items in the menu, different buttons visible on the rest of the app.

Also, I don't want to allow them to access part of the site that they shouldn't be able to just by typing the URL.

I have created a middleware, UserRoleChecker, and added it to all my routes like this:

//Middleware
public function handle(Request $request, Closure $next)
    {
        if (auth()->check() && auth()->user()->user_status == 0) {

            return redirect('profile');
        }
        return $next($request);
    }

//Routes
Route::get('/profile', 'App\Http\Controllers\UsersController@ShowLoggedInUserProfile')->middleware(['auth','UserRole'])->name('profile');

But I would love to check if this is the right way to implement this controls. Should I also add some controls to every controller or even blade template for this? Is this even enough to make what I need?

Also - this exact code I posted gives me an endless redirect error in the browser - how can I get around that? The only solution I found is to remote UserRole from middleware in the Profile route, but that means no controls, right?

Snapey

2 years ago

Level 122

you try to visit profile, are allowed to visit profile, but get redirected to profile - an endless loop!

you need to flip your logic

return $next($request) when you are happy with the route being taken

redirect when you don't like what they are doing and want to bounce them somewhere else

In this case, middleware is a doorman - come in here with your smart trousers, or REDIRECT you to the club down the road that has lower standards

but it's impractical to have a unique middleware for every route, you need to group them . What status does user_status ==0 mean with its magic number of zero?

blackshtef

2 years ago

Level 1

@Snapey So, the user_status == 0 means that the user account is not activated - not ready to see the whole application, only the profile page. Once it gets activated, it will become user_status == 1, which means a regular user.

Snapey

2 years ago

Level 122

@blackshtef so you need middleware like 'active' that only active users can get through to access those routes wrapped in active middleware

PovilasKorop

2 years ago

Level 11

@blackshtef well it's not logical to check the profile for status and then redirect to the same profile if status is 0.

You need to use that middleware on OTHER routes EXCEPT profile.

Please or to participate in this conversation.