User roles in Laravel 6

Can you post the CheckRole code?

It sounds as though it's working as intended. You say if you login as admin and send a request you are allowed to proceed. If you don't have permission, a 403 is returned.

That's the concept of route middleware.

Please post your middleware code.

Wow - that was quick - thanks :) Here's the code:

<?php

namespace App\Http\Middleware;

use App\Models\Role;
use Closure;
use Illuminate\Support\Facades\App;

class CheckRole
{
    public function handle($request, Closure $next, string $role)
    {
        $roleId = Role::whereTitle(ucfirst($role))->first()->id;

        if (!$request->user()) {
            return redirect('login');
        } else if (!$request->user()->hasRole($roleId)) {
            return App::abort(403);
        }

       // This is where I stand before getting redirected

        return $next($request);
    }
}

Venter på Mortens and så skulle bruge tiden på noget :)

It seems that the issue is that it runs the middleware twice and fails at the second iteration. (once for writer and one for admin). You could probably do something like this

$this->middleware(['role:writer|admin']);

else if (!$request->user()->hasAnyRole(explode("|", $role))

AMAZING - and I am shouting :) Of cause it runs twice. It escaped my attention.

I was assuming from the documentation that this did apply to my case too:

Route::get('/', function () {
    //
})->middleware('first', 'second');

So, I definitely need to find another way to handle multiple roles. Your idea is good, and I'll base the solution on that.

Thanks a lot!

And bon appétit with Mortens and :) Tak for hjælpen Sinnbeck :)

Happy to help. If it helped you solve the issue, please mark "best answer"

The final solution was simple, when I understood the problem - and is more of a DOH than an AHA.

Problem: Users with roles admin and writershould have access to the controller.

Solution: The middleware must require the "lowest" role, i.e. role:writer. So now the writer has acces. The admin must have writer access too - and also admin access, so admin gets both roles.

And the code from the middleware class CheckRole:

$usersRoles = $request->user()->roles->pluck('id')->toArray();

 if (!$request->user()) {
     return redirect('login');
 } else if (!in_array($roleId, $usersRoles)) {
     return App::abort(403);
 }

 return $next($request);

And in the controller's constructor:

$this->middleware(['role:writer']);