Roles Permissions - AuthServiceProvider - Auth User Null

I think your getPermissions method should be responsible for only getting the permissions of the given user.

I currently have a middleware in place which is checking if the user is allowed to enter a certain route. So the permission name is the same as the route name.

<?php

namespace App\Http\Middleware;

use Closure;

class IsAuthorized
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if (hasPermission($request->route()->getName())) {
            return $next($request);
        }

        // TODO: Replace with API response
        abort(403, 'Unauthorized action.');
    }
}

The hasPermission looks like this, which is stored in a helpers.php file so I can call the method everywhere. The method is really fast because it uses caching for the permissions.

// helpers.php

function hasPermission($route)
{
    $key = 'permissions' . auth()->user()->id;

    $permissions = Cache::remember($key, config('feestgemak.cache_minutes'), function () {
        $collection = collect();

        auth()->user()->load('roles.permissions');

        foreach (auth()->user()->roles as $role) {
            foreach ($role->permissions as $permission) {
                $collection->push($permission->name);
            }
        }

        return $collection;
    });

    return $permissions->contains($route);
}

However this setup is a bit different from yours. I have roles and permissions separate. A user has one or many roles and each role has one or many permissions.

Generally a permission is assigned to a role and a role to a user. Though not required, generally as it's cleaner then assigning a bunch of users a bunch of permissions.

I set a Role and Permission Model with a table each Then two pivot tables (if you want a possibility a a user having more then one role)

role_user permission_role

class User
{
    public function hasRole($roleSlug)
    {
        foreach($this->roles as $role)
        {
            if($role->slug == $roleSlug) {
                return true; // has role
        }
        return false; // not assigned
    }

    public function hasPermission($permisisonSlug)
    {
        foreach($this->roles()->with('permisisons')->get() as $role) {
            foreach($role->permissions as $permission) {
                if($permission->slug == $permisisonSlug) {
                    return true; // has the permission assigned
                }
            }
        }
        return false; // does not have a role with applicable permission
    }
}

Nothing wrong with your attempt persay, just backwards from the norm is all.

@bobbybouwmann is a bit different, but along the same lines as above.

I to set dynamic middlewares:

Route::middleware('permission:can_post')
// or 
Route::middleware('role:admin')

Though many times the Role isn't hardcoded, but permissions are as a role's permissions probably can change.

Thanks guys for your input - it has helped immensely!

I have reviewed my code to tried your suggestions above, which has helped me to find the errors in my code (thank you!)...

First Mistake: The 'Gate' class in 'AuthServiceProvider.php' - it needed a prefix for the constant (i.e. 'admin' for the 1st table and 'demo' for the 2nd table. This just reinforce that there is no sharing of the permission tables (which there was in my case, if both permissions table had the same values)...

    //Example of Missing Prefix for Constant... 
        Gate::define($permission_demo->section . '_' . $permission_demo->access_type,
          function ($user) use ($permission_demo)

    //Example of adding Prefix... 
        Gate::define($permission_demo->database_type . '_' .$permission_demo->section . '_' . $permission_demo->access_type,
          function ($user) use ($permission_demo)

Second Mistake: I have multiple guards in my 'auth.php' file. However, it was only the 'default' guard that was working, which I didn't realize at the time. To my understanding - you needed to specify a guard and consequently bind it to the 'auth' middleware route. In my example, I used the constructor in the controllers to achieve this...

class AdminController extends Controller {

  protected $guard = 'admin';


  /**|--------------------------------------------------------------------------
  | Administration Controller - Incorrect Setup for Multiple Guards
  |----------------------------------------------------------------------------- */

  public function __construct(){
    $this->middleware('admin');
  }

class AdminController extends Controller {

  protected $guard = 'admin';


  /**|--------------------------------------------------------------------------
  | Administration Controller - Correct Setup for Multiple Guards
  |----------------------------------------------------------------------------- */

  public function __construct(){
    $this->middleware('auth:admin');
  }

Thanks again guys for your help - it was much appreciated!