Bài 24: Phân quyền với gate và policy

  

-    Vào terminal chạy: php artisan make:policy CategoryPolicy --model=Category

-    Vào AuthServiceProvider.php

    public function boot()
    {
        $this->registerPolicies();
        $this->defineGateCategory();
    }
    public function defineGateCategory(){
        Gate::define('category_list','App\Policies\CategoryPolicy@view');
        Gate::define('category_add','App\Policies\CategoryPolicy@create');
        Gate::define('category_edit','App\Policies\CategoryPolicy@update');
        Gate::define('category_delete','App\Policies\CategoryPolicy@delete');
    }
    
}

-    Vào CategoryPolicy.php

<?php

namespace App\Policies;

use App\User;
use App\Category;
use Illuminate\Auth\Access\HandlesAuthorization;

class CategoryPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any categories.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function viewAny(User $user)
    {
        //
    }

    /**
     * Determine whether the user can view the category.
     *
     * @param  \App\User  $user
     * @param  \App\Category  $category
     * @return mixed
     */
    public function view(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.list_category'));
    }

    /**
     * Determine whether the user can create categories.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function create(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.add_category'));
    }

    /**
     * Determine whether the user can update the category.
     *
     * @param  \App\User  $user
     * @param  \App\Category  $category
     * @return mixed
     */
    public function update(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.edit_category'));
    }

    /**
     * Determine whether the user can delete the category.
     *
     * @param  \App\User  $user
     * @param  \App\Category  $category
     * @return mixed
     */
    public function delete(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.delete_category'));
    }

    /**
     * Determine whether the user can restore the category.
     *
     * @param  \App\User  $user
     * @param  \App\Category  $category
     * @return mixed
     */
    public function restore(User $user, Category $category)
    {
        //
    }

    /**
     * Determine whether the user can permanently delete the category.
     *
     * @param  \App\User  $user
     * @param  \App\Category  $category
     * @return mixed
     */
    public function forceDelete(User $user, Category $category)
    {
        //
    }
}

-    Vào permissions.php

<?php

return[
  'access'=>[
      'list_category'=>'category_list',
      'add_category'=>'category_add',
      'edit_category' => 'category_edit',
      'delete_category' => 'category_delete',
      'list_menu' => 'menu_list',
  ],
    'table_module' =>[
        'category',
        'slider',
        'menu',
        'product',
        'setting',
        'user',
        'role'
    ],
    'module_childrent' =>[
        'list',
        'add',
        'edit',
        'delete'
    ]

];

-    Vào web.php

//category
Route::prefix('categories')->group(function () {
    Route::get('/',[
        'as'=> 'categories.index',
        'uses' => 'CategoryController@index',
        'middleware'=>'can:category_list',
    ]);

    Route::get('/create',[
        'as'=> 'categories.create',
        'uses' => 'CategoryController@create',
        'middleware'=>'can:category_add',
    ]);
    Route::post('/store',[
        'as'=> 'categories.store',
        'uses' => 'CategoryController@store'
    ]);
    Route::get('/edit/{id}',[
        'as'=> 'categories.edit',
        'uses' => 'CategoryController@edit',
        'middleware'=>'can:category_edit',
    ]);
    Route::post('/update/{id}',[
        'as'=> 'categories.update',
        'uses' => 'CategoryController@update'
    ]);
    Route::get('/delete/{id}',[
        'as'=> 'categories.delete',
        'uses' => 'CategoryController@delete',
        'middleware'=>'can:category_delete',
    ]);
});

Menu

-    Vào terminal chạy: php artisan make:policy MenuPolicy --model=Menu
-    Vào AuthServiceProvider.php
public function boot()
{
$this->defineGateMenu();
}
public function defineGateMenu(){
Gate::define('menu_list','App\Policies\MenuPolicy@view');
Gate::define('menu_add','App\Policies\MenuPolicy@create');
Gate::define('menu_edit','App\Policies\MenuPolicy@update');
Gate::define('menu_delete','App\Policies\MenuPolicy@delete');
}
<?php
namespace App\Policies;

use App\User;
use App\Menu;
use Illuminate\Auth\Access\HandlesAuthorization;

class MenuPolicy
{
use HandlesAuthorization;
public function view(User $user)
{
return $user->checkPermissionAccess(config('permissions.access.list_menu'));
}
public function create(User $user)
{
return $user->checkPermissionAccess(config('permissions.access.add_menu'));
}

public function update(User $user)
{
return $user->checkPermissionAccess(config('permissions.access.edit_menu'));
}

public function delete(User $user)
{
return $user->checkPermissionAccess(config('permissions.access.delete_menu'));
}
}
-    Vào permissions.php
'access'=>[
//
'list_menu'=>'menu_list',
'add_menu'=>'menu_add',
'edit_menu' => 'menu_edit',
'delete_menu' => 'menu_delete',

],
-    Vào web.php
//menu
Route::prefix('menus')->group(function () {
Route::get('/',[
'as'=> 'menus.index',
'uses' => 'MenuController@index',
'middleware'=>'can:menu_list',
]);
Route::get('/create',[
'as'=> 'menus.create',
'uses' => 'MenuController@create',
'middleware'=>'can:menu_add',
]);
Route::post('/store',[
'as'=> 'menus.store',
'uses' => 'MenuController@store'
]);
Route::get('/edit/{id}',[
'as'=> 'menus.edit',
'uses' => 'MenuController@edit',
'middleware'=>'can:menu_edit',
]);
Route::post('/update/{id}',[
'as'=> 'menus.update',
'uses' => 'MenuController@update'
]);
Route::get('/delete/{id}',[
'as'=> 'menus.delete',
'uses' => 'MenuController@delete',
'middleware'=>'can:menu_delete',
]);
});

-    Vào MenuPolicy.php

<?php

namespace App\Policies;

use App\User;
use App\Menu;
use Illuminate\Auth\Access\HandlesAuthorization;

class MenuPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any menus.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function viewAny(User $user)
    {
        //
    }

    /**
     * Determine whether the user can view the menu.
     *
     * @param  \App\User  $user
     * @param  \App\Menu  $menu
     * @return mixed
     */
    public function view(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.list_menu'));
    }

    /**
     * Determine whether the user can create menus.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function create(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.add_menu'));
    }

    /**
     * Determine whether the user can update the menu.
     *
     * @param  \App\User  $user
     * @param  \App\Menu  $menu
     * @return mixed
     */
    public function update(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.edit_menu'));
    }

    /**
     * Determine whether the user can delete the menu.
     *
     * @param  \App\User  $user
     * @param  \App\Menu  $menu
     * @return mixed
     */
    public function delete(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.delete_menu'));
    }

    /**
     * Determine whether the user can restore the menu.
     *
     * @param  \App\User  $user
     * @param  \App\Menu  $menu
     * @return mixed
     */
    public function restore(User $user, Menu $menu)
    {
        //
    }

    /**
     * Determine whether the user can permanently delete the menu.
     *
     * @param  \App\User  $user
     * @param  \App\Menu  $menu
     * @return mixed
     */
    public function forceDelete(User $user, Menu $menu)
    {
        //
    }
}

-    Vào permissions.php

<?php

return[
  'access'=>[
        //
      'list_menu'=>'menu_list',
      'add_menu'=>'menu_add',
      'edit_menu' => 'menu_edit',
      'delete_menu' => 'menu_delete',
  ],
];

-    Vào web.php

//menu
Route::prefix('menus')->group(function () {
    Route::get('/',[
        'as'=> 'menus.index',
        'uses' => 'MenuController@index',
        'middleware'=>'can:menu_list',
    ]);
    Route::get('/create',[
        'as'=> 'menus.create',
        'uses' => 'MenuController@create',
        'middleware'=>'can:menu_add',
    ]);
    Route::post('/store',[
        'as'=> 'menus.store',
        'uses' => 'MenuController@store'
    ]);
    Route::get('/edit/{id}',[
        'as'=> 'menus.edit',
        'uses' => 'MenuController@edit',
        'middleware'=>'can:menu_edit',
    ]);
    Route::post('/update/{id}',[
        'as'=> 'menus.update',
        'uses' => 'MenuController@update'
    ]);
    Route::get('/delete/{id}',[
        'as'=> 'menus.delete',
        'uses' => 'MenuController@delete',
        'middleware'=>'can:menu_delete',
    ]);
});

Slider

-    Vào terminal chạy: php artisan make:policy SliderPolicy --model=Slider

-    Vào AuthServiceProvider.php

    public function boot()
    {
        $this->defineGateSlider();
    }
    //
    public function defineGateSlider(){
        Gate::define('slider_list','App\Policies\SliderPolicy@view');
        Gate::define('slider_add','App\Policies\SliderPolicy@create');
        Gate::define('slider_edit','App\Policies\SliderPolicy@update');
        Gate::define('slider_delete','App\Policies\SliderPolicy@delete');
    }

}

-    Vào SliderPolicy.php

<?php

namespace App\Policies;

use App\User;
use App\Slider;
use Illuminate\Auth\Access\HandlesAuthorization;

class SliderPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any sliders.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function viewAny(User $user)
    {
        //
    }

    /**
     * Determine whether the user can view the slider.
     *
     * @param  \App\User  $user
     * @param  \App\Slider  $slider
     * @return mixed
     */
    public function view(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.list_slider'));
    }

    /**
     * Determine whether the user can create sliders.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function create(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.add_slider'));
    }

    /**
     * Determine whether the user can update the slider.
     *
     * @param  \App\User  $user
     * @param  \App\Slider  $slider
     * @return mixed
     */
    public function update(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.edit_slider'));
    }

    /**
     * Determine whether the user can delete the slider.
     *
     * @param  \App\User  $user
     * @param  \App\Slider  $slider
     * @return mixed
     */
    public function delete(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.delete_slider'));
    }

    /**
     * Determine whether the user can restore the slider.
     *
     * @param  \App\User  $user
     * @param  \App\Slider  $slider
     * @return mixed
     */
    public function restore(User $user, Slider $slider)
    {
        //
    }

    /**
     * Determine whether the user can permanently delete the slider.
     *
     * @param  \App\User  $user
     * @param  \App\Slider  $slider
     * @return mixed
     */
    public function forceDelete(User $user, Slider $slider)
    {
        //
    }
}

-    Vào permissions.php

<?php

return[
  'access'=>[
      'list_slider'=>'slider_list',
      'add_slider'=>'slider_add',
      'edit_slider' => 'slider_edit',
      'delete_slider' => 'slider_delete',
  ],
];

-    Vào web.php

//Slider
Route::prefix('slider')->group(function () {
    Route::get('/',[
        'as'=> 'slider.index',
        'uses' => 'SliderAdminController@index',
        'middleware'=>'can:slider_list',
    ]);
    Route::get('/create',[
        'as'=> 'slider.create',
        'uses' => 'SliderAdminController@create',
        'middleware'=>'can:slider_add',
    ]);
    Route::post('/store',[
        'as'=> 'slider.store',
        'uses' => 'SliderAdminController@store'
    ]);
    Route::get('/edit/{id}',[
        'as'=> 'slider.edit',
        'uses' => 'SliderAdminController@edit',
        'middleware'=>'can:slider_edit',
    ]);
    Route::post('/update/{id}',[
        'as'=> 'slider.update',
        'uses' => 'SliderAdminController@update'
    ]);
    Route::get('/delete/{id}',[
        'as'=> 'slider.delete',
        'uses' => 'SliderAdminController@delete',
        'middleware'=>'can:slider_delete',
    ]);
});

Setting

-    Vào terminal chạy: php artisan make:policy SliderPolicy --model=Slider

-    Vào AuthServiceProvider.php

    public function boot()
    {
      //
        $this->defineGateSetting();

    }
//
    public function defineGateSetting(){
        Gate::define('setting_list','App\Policies\SettingPolicy@view');
        Gate::define('setting_add','App\Policies\SettingPolicy@create');
        Gate::define('setting_edit','App\Policies\SettingPolicy@update');
        Gate::define('setting_delete','App\Policies\SettingPolicy@delete');
    }

}

-    VàoSettingPolicy.php

<?php

namespace App\Policies;

use App\User;
use App\Setting;
use Illuminate\Auth\Access\HandlesAuthorization;

class SettingPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any settings.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function viewAny(User $user)
    {
        //
    }

    /**
     * Determine whether the user can view the setting.
     *
     * @param  \App\User  $user
     * @param  \App\Setting  $setting
     * @return mixed
     */
    public function view(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.list_setting'));
    }

    /**
     * Determine whether the user can create settings.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function create(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.add_setting'));
    }

    /**
     * Determine whether the user can update the setting.
     *
     * @param  \App\User  $user
     * @param  \App\Setting  $setting
     * @return mixed
     */
    public function update(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.edit_setting'));
    }

    /**
     * Determine whether the user can delete the setting.
     *
     * @param  \App\User  $user
     * @param  \App\Setting  $setting
     * @return mixed
     */
    public function delete(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.delete_setting'));
    }

    /**
     * Determine whether the user can restore the setting.
     *
     * @param  \App\User  $user
     * @param  \App\Setting  $setting
     * @return mixed
     */
    public function restore(User $user, Setting $setting)
    {
        //
    }

    /**
     * Determine whether the user can permanently delete the setting.
     *
     * @param  \App\User  $user
     * @param  \App\Setting  $setting
     * @return mixed
     */
    public function forceDelete(User $user, Setting $setting)
    {
        //
    }
}

-    Vào permissions.php

<?php

return[
  'access'=>[
      //
      'list_setting'=>'setting_list',
      'add_setting'=>'setting_add',
      'edit_setting' => 'setting_edit',
      'delete_setting' => 'setting_delete',
  ],
    
];

-    Vào web.php

//Settings
Route::prefix('settings')->group(function () {
    Route::get('/',[
        'as'=> 'settings.index',
        'uses' => 'AdminSettingController@index',
        'middleware'=>'can:setting_list',
    ]);
    Route::get('/create',[
        'as'=> 'settings.create',
        'uses' => 'AdminSettingController@create',
        'middleware'=>'can:setting_add',
    ]);
    Route::post('/store',[
        'as'=> 'settings.store',
        'uses' => 'AdminSettingController@store'
    ]);
    Route::get('/edit/{id}',[
            'as'=> 'settings.edit',
        'uses' => 'AdminSettingController@edit',
        'middleware'=>'can:setting_edit',
    ]);
    Route::post('/update/{id}',[
        'as'=> 'settings.update',
        'uses' => 'AdminSettingController@update'
    ]);
    Route::get('/delete/{id}',[
        'as'=> 'settings.delete',
        'uses' => 'AdminSettingController@delete',
        'middleware'=>'can:setting_delete',
    ]);
});

User

-    Vào terminal chạy: php artisan make:policy UserPolicy --model=User

-    Vào AuthServiceProvider.php

    public function boot()
    {
       //
        $this->defineGateUser();
    }
   //
    public function defineGateUser(){
        Gate::define('user_list','App\Policies\UserPolicy@view');
        Gate::define('user_add','App\Policies\UserPolicy@create');
        Gate::define('user_edit','App\Policies\UserPolicy@update');
        Gate::define('user_delete','App\Policies\UserPolicy@delete');
    }

}

-    Vào UserPolicy.php

<?php

namespace App\Policies;

use App\User;
use Illuminate\Auth\Access\HandlesAuthorization;

class UserPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any models.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function viewAny(User $user)
    {
        //
    }

    /**
     * Determine whether the user can view the model.
     *
     * @param  \App\User  $user
     * @param  \App\User  $model
     * @return mixed
     */
    public function view(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.list_user'));
    }

    /**
     * Determine whether the user can create models.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function create(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.add_user'));
    }

    /**
     * Determine whether the user can update the model.
     *
     * @param  \App\User  $user
     * @param  \App\User  $model
     * @return mixed
     */
    public function update(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.edit_user'));
    }

    /**
     * Determine whether the user can delete the model.
     *
     * @param  \App\User  $user
     * @param  \App\User  $model
     * @return mixed
     */
    public function delete(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.delete_user'));
    }

    /**
     * Determine whether the user can restore the model.
     *
     * @param  \App\User  $user
     * @param  \App\User  $model
     * @return mixed
     */
    public function restore(User $user, User $model)
    {
        //
    }

    /**
     * Determine whether the user can permanently delete the model.
     *
     * @param  \App\User  $user
     * @param  \App\User  $model
     * @return mixed
     */
    public function forceDelete(User $user, User $model)
    {
        //
    }
}

-    Vào permissions.php

<?php

return[
  'access'=>[
     //
      'list_user'=>'user_list',
      'add_user'=>'user_add',
      'edit_user' => 'user_edit',
      'delete_user' => 'user_delete',
  ],
];

-    Vào web.php

//User
Route::prefix('users')->group(function () {
    Route::get('/',[
        'as'=> 'users.index',
        'uses' => 'AdminUserController@index',
        'middleware'=>'can:user_list',
    ]);
    Route::get('/create',[
        'as'=> 'users.create',
        'uses' => 'AdminUserController@create',
        'middleware'=>'can:user_add',
    ]);
    Route::post('/store',[
        'as'=> 'users.store',
        'uses' => 'AdminUserController@store'
    ]);
    Route::get('/edit/{id}',[
        'as'=> 'users.edit',
        'uses' => 'AdminUserController@edit',
        'middleware'=>'can:user_edit',
    ]);
    Route::post('/update/{id}',[
        'as'=> 'users.update',
        'uses' => 'AdminUserController@update'
    ]);
    Route::get('/delete/{id}',[
        'as'=> 'users.delete',
        'uses' => 'AdminUserController@delete',
        'middleware'=>'can:user_delete',
    ]);
});

Role

-    Vào terminal chạy:php artisan make:policy RolePolicy --model=Role

-    Vào AuthServiceProvider.php

    public function boot()
    {
       //
        $this->defineGateRole();
    }
//
    public function defineGateRole(){
        Gate::define('role_list','App\Policies\RolePolicy@view');
        Gate::define('role_add','App\Policies\RolePolicy@create');
        Gate::define('role_edit','App\Policies\RolePolicy@update');
        Gate::define('role_delete','App\Policies\RolePolicy@delete');
    }
}

-    Vào RolePolicy.php

<?php

namespace App\Policies;

use App\User;
use App\Role;
use Illuminate\Auth\Access\HandlesAuthorization;

class RolePolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any roles.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function viewAny(User $user)
    {
        //
    }

    /**
     * Determine whether the user can view the role.
     *
     * @param  \App\User  $user
     * @param  \App\Role  $role
     * @return mixed
     */
    public function view(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.list_role'));
    }

    /**
     * Determine whether the user can create roles.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function create(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.add_role'));//
    }

    /**
     * Determine whether the user can update the role.
     *
     * @param  \App\User  $user
     * @param  \App\Role  $role
     * @return mixed
     */
    public function update(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.edit_role'));
    }

    /**
     * Determine whether the user can delete the role.
     *
     * @param  \App\User  $user
     * @param  \App\Role  $role
     * @return mixed
     */
    public function delete(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.delete_role'));
    }

    /**
     * Determine whether the user can restore the role.
     *
     * @param  \App\User  $user
     * @param  \App\Role  $role
     * @return mixed
     */
    public function restore(User $user, Role $role)
    {
        //
    }

    /**
     * Determine whether the user can permanently delete the role.
     *
     * @param  \App\User  $user
     * @param  \App\Role  $role
     * @return mixed
     */
    public function forceDelete(User $user, Role $role)
    {
        //
    }
}

-    Vào permissions.php

<?php

return[
  'access'=>[
    //
      'list_role'=>'role_list',
      'add_role'=>'role_add',
      'edit_role' => 'role_edit',
      'delete_role' => 'role_delete',
  ],
];

-    Vào web.php

//Role
Route::prefix('roles')->group(function () {
    Route::get('/',[
        'as'=> 'roles.index',
        'uses' => 'AdminRoleController@index',
        'middleware'=>'can:role_list',
    ]);
    Route::get('/create',[
        'as'=> 'roles.create',
        'uses' => 'AdminRoleController@create',
        'middleware'=>'can:role_add',
    ]);
    Route::post('/store',[
        'as'=> 'roles.store',
        'uses' => 'AdminRoleController@store'
    ]);
    Route::get('/edit/{id}',[
        'as'=> 'roles.edit',
        'uses' => 'AdminRoleController@edit',
        'middleware'=>'can:role_edit',
    ]);
    Route::post('/update/{id}',[
        'as'=> 'roles.update',
        'uses' => 'AdminRoleController@update'
    ]);
    Route::get('/delete/{id}',[
        'as'=> 'roles.delete',
        'uses' => 'AdminRoleController@delete',
        'middleware'=>'can:role_delete',
    ]);
});

Product

-    Vào terminal chạy: php artisan make:policy ProductPolicy --model=Product

-    Vào AuthServiceProvider.php

    public function boot()
    {
      //
        $this->defineGateProduct();
    }
    //
    public function defineGateProduct(){
        Gate::define('product_list','App\Policies\ProductPolicy@view');
        Gate::define('product_add','App\Policies\ProductPolicy@create');
        Gate::define('product_edit','App\Policies\ProductPolicy@update');
        Gate::define('product_delete','App\Policies\ProductPolicy@delete');
    }
}

-    Vào ProductPolicy.php

<?php

namespace App\Policies;

use App\User;
use App\Product;
use Illuminate\Auth\Access\HandlesAuthorization;

class ProductPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any products.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function viewAny(User $user)
    {
        //
    }

    /**
     * Determine whether the user can view the product.
     *
     * @param  \App\User  $user
     * @param  \App\Product  $product
     * @return mixed
     */
    public function view(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.list_product'));
    }

    /**
     * Determine whether the user can create products.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function create(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.add_product'));
    }

    /**
     * Determine whether the user can update the product.
     *
     * @param  \App\User  $user
     * @param  \App\Product  $product
     * @return mixed
     */
    public function update(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.edit_product'));
    }

    /**
     * Determine whether the user can delete the product.
     *
     * @param  \App\User  $user
     * @param  \App\Product  $product
     * @return mixed
     */
    public function delete(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.delete_product'));
    }

    /**
     * Determine whether the user can restore the product.
     *
     * @param  \App\User  $user
     * @param  \App\Product  $product
     * @return mixed
     */
    public function restore(User $user, Product $product)
    {
        //
    }

    /**
     * Determine whether the user can permanently delete the product.
     *
     * @param  \App\User  $user
     * @param  \App\Product  $product
     * @return mixed
     */
    public function forceDelete(User $user, Product $product)
    {
        //
    }
}

-    Vào permissions.php

<?php

return[
  'access'=>[
      //
      'list_product'=>'product_list',
      'add_product'=>'product_add',
      'edit_product' => 'product_edit',
      'delete_product' => 'product_delete',
  ],
];

-    Vào web.php

//Product
Route::prefix('product')->group(function () {
    Route::get('/',[
        'as'=> 'product.index',
        'uses' => 'AdminProductController@index',
        'middleware'=>'can:product_list',
    ]);
    Route::get('/create',[
        'as'=> 'product.create',
        'uses' => 'AdminProductController@create',
        'middleware'=>'can:product_add',
    ]);
    Route::post('/store',[
        'as'=> 'product.store',
        'uses' => 'AdminProductController@store'
    ]);
    Route::get('/edit/{id}',[
        'as'=> 'product.edit',
        'uses' => 'AdminProductController@edit',
        'middleware'=>'can:product_edit',

    ]);
    Route::post('/update/{id}',[
        'as'=> 'product.update',
        'uses' => 'AdminProductController@update'
    ]);
    Route::get('/delete/{id}',[
        'as'=> 'product.delete',
        'uses' => 'AdminProductController@delete',
        'middleware'=>'can:product_delete',
    ]);
});

-    Xong phân quyền.