Laravel-permission show specific roles and permission

To achieve the functionality where a CBO user can create their roles and assign permissions, while only being able to see their specific roles and permissions, you can use Laravel's built-in authorization features along with the laravel-permission package by Spatie.

Here's a step-by-step solution:

1. Define Permissions and Roles: First, ensure that you have defined the necessary permissions and roles in your system. For example, you might have a permission like create roles and assign permissions.

2. Assign Permissions to Roles: Assign the appropriate permissions to the admin and CBO roles. The admin role should have all permissions, while the CBO role should have permissions to create roles and assign permissions but limited to their scope.

3. Scope Roles and Permissions for CBO: You will need to implement a way to scope the roles and permissions that a CBO user can access. This can be done by adding a created_by field to the roles table, which references the user who created the role.

4. Filter Roles and Permissions: When listing roles and permissions for a CBO user, filter them by the created_by field to only show the roles and permissions created by that CBO user.

Here's an example of how you might implement this:

// Migration to add created_by to roles table
Schema::table('roles', function (Blueprint $table) {
    $table->foreignId('created_by')->nullable()->constrained('users')->onDelete('set null');
});

// In your RoleController or equivalent
public function index()
{
    // Get the current user
    $user = auth()->user();

    // Check if the user is an admin or CBO
    if ($user->hasRole('admin')) {
        // Admin can see all roles
        $roles = Role::all();
    } elseif ($user->hasRole('CBO')) {
        // CBO can only see roles they created
        $roles = Role::where('created_by', $user->id)->get();
    } else {
        // Other users shouldn't see any roles
        $roles = collect();
    }

    // Pass the roles to the view
    return view('roles.index', compact('roles'));
}

// When creating a role as a CBO user
public function store(Request $request)
{
    $user = auth()->user();

    // Validate the request...

    // Create a new role and assign the CBO user as the creator
    $role = Role::create(['name' => $request->name, 'created_by' => $user->id]);

    // Assign permissions to the role...
}

1. Assigning Permissions: When assigning permissions to a role, ensure that the CBO user can only assign permissions that they themselves have.

// In your PermissionController or equivalent
public function assign(Request $request, Role $role)
{
    $user = auth()->user();

    // Ensure the role was created by the CBO user
    if ($role->created_by !== $user->id) {
        abort(403);
    }

    // Get the permissions the user can assign
    $permissions = $user->getAllPermissions();

    // Assign the permissions to the role
    $role->syncPermissions($request->permissions);

    // Redirect or return response...
}

Remember to handle authorization checks appropriately in your controllers to ensure that users can only perform actions they are permitted to do. You can use middleware, policies, or explicit checks within your controller methods to enforce these rules.

This solution assumes that you have a good understanding of how the laravel-permission package works and how to integrate it with Laravel's authorization system. If you're not familiar with these concepts, I recommend reading the Laravel documentation on authorization and the laravel-permission package documentation.