Mastering Permissions in Laravel
User authorization is one of the most complex systems to build in your application, but also one of the most essential. From setting up role-based access and custom policies to exploring advanced permissions - and group-based authorization - you’ll gain the skills needed to build secure, scalable applications. Join me as I guide you through everything required to incorporate a robust user authorization system into your application.
Progress
Series Info
- Episodes
- 17
- Run Time
- 2h 39m
- Difficulty
- Advanced
- Last Updated
- Nov 25, 2024
- Version
- Latest
Series Episodes
- Authorization Basics (2)
The Admin Column
The most simple user authorization system relies upon a single "admin" column in the users table. Let's look at how it works in this episode.Using Gates
Discover how to use Gates to control access at a more granular level. We’ll explore setting up and defining Gates to enforce permission checks throughout your application.
- Building a Roles-Based System (4)
Implementing Role-based Access System
Role-based systems are extremely common in applications because they're relatively simple to implement and maintain, and they provide more flexibility than the admin column.Creating Middleware to Guard Routes
Laravel doesn't have a built-in mechanic for authorizing role-based user access. So, let's create some middleware that provides functionality similar to Laravel's built-in authorization tools.Making Custom Directives
We want an easy way to check for a user's role(s) in our views. So, let's create a custom@roledirective to emulate Laravel's@candirective.Loading Roles Into Context
Checking a user's roles relies upon a database query. So, multiple checks can cause multiple queries. Let's make it more efficient by loading the user's roles into theContext.
- Using Policies (5)
Creating Policies
Laravel's Policies allow us to organize authorization rules into a single class. In this episode, we'll define a policy for working with theArticlemodel/resource.Defining and Using Abilities
Policies use ability methods to enforce consistent permissions across our application. In this episode, we'll define ability methods that wrap our role-based authorization logic.Completing the Policy
Once you start using a policy for a given model or resource, it makes sense to completely use the policy for user access. Let's fully implement ourArticlePolicy.Managing Roles
Role-based systems typically have the ability to create, edit, and delete roles, as well as assign them to users. We'll start to implement those pieces in this episode.Protecting Roles
It's not enough to be able to manage roles; we need to protect them from unintended changes. In this episode, we'll implement a system to better protect roles from being changed.
- Permissions/Claims and Groups (6)
Transitioning to Permissions
Role-based systems are very common and provide flexibility, but sometimes you just need more control. In this episode, we'll start to transition to a permission... or claims-based system. Policies make it really easy to do!Implementing Groups
Managing the permissions that are assigned to users can be a tedious process, but we can alleviate that by using groups. In this episode, we'll start a group-based system.Assigning Users to Groups
Groups are pointless if we can't assign users to those groups. So, in this episode, we'll write the ability to add users to groups. It's nothing new, really--we've done it before but with different entities.Loading Permissions Into Context
We can check if a user is in a particular group, but ultimately, it boils down to whether a user has (or not) the permissions to access something. So, we'll load the permissions into theContextto make it easier to check them.Implementing Negative Permissions
Negative permissions allow you to explicitly deny access, and they are essential to any permission-based system. This episode will show you how to implement negative permissions in your applications.Using Enums
We're human, and since we use string literals throughout the application to check permissions and abilities, we will eventually mistype one of these very important values. Instead, we can refactor our code to rely on enums, which makes our code resistant to errors and easier to maintain.
