I am still not sure which design would be better:
Let's say I have many many routes. They are actually well organized in groups per routes, and some has many resources, so not just one post or one get:
Route::prefix('route_x')->group(function () {
Route::get('/',
Route::post('/store',
Route::get('/{id}/sub_route_x',
Route::post('{id}/sub_route_x/store',
});
Route::prefix('route_y')->group(function () {
Route::get('/',
Route::post('/store',
Route::get('/{id}/sub_route_y',
Route::post('/{id}/sub_route_y/store',
});
Now the app has a lot of indivudual screens and many groups of users that can use individual routes, and within these groups it's also divided to managers, staff and so on.
What would be a better way to implement authorization:
- Use role-based authorization, and then use it like so:
Route::prefix('route_x')->group(function () {
Route::middleware(['role:route_x_managers,route_x_staff'])->group(function () {
Route::get('/',
Route::post('/store',
});
Route::middleware(['role:route_x_managers'])->group(function () {
Route::get('/{id}/sub_route_x',
Route::post('{id}/sub_route_x/store',
});
});
- Or, use it with gates and authorize routes per the route and the resources themselves:
Route::prefix('route_x')->group(function () {
Route::middleware(['can:use_route_x'])->group(function () {
Route::get('/',
Route::post('/store',
});
Route::middleware(['can:use_route_x_sub_routes'])->group(function () {
Route::get('/{id}/sub_route_x',
Route::post('{id}/sub_route_x/store',
});
});
Or another solution?