Bài 25: Phân quyền với gate và policy

 

Chỉ có user tạo ra product mới có quyền sửa product đó.

-    Vào AuthServiceProvider.php

<?php

namespace App\Providers;

use App\Product;
use Illuminate\Support\Facades\Gate;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;

class AuthServiceProvider extends ServiceProvider
{
    /**
     * The policy mappings for the application.
     *
     * @var array
     */
    protected $policies = [
        // 'App\Model' => 'App\Policies\ModelPolicy',
    ];

    /**
     * Register any authentication / authorization services.
     *
     * @return void
     */
    public function boot()
    {
        $this->registerPolicies();
        $this->defineGateCategory();
        $this->defineGateMenu();
        $this->defineGateSlider();
        $this->defineGateSetting();
        $this->defineGateUser();
        $this->defineGateRole();
        $this->defineGateProduct();
    }
    public function defineGateCategory(){
        Gate::define('category_list','App\Policies\CategoryPolicy@view');
        Gate::define('category_add','App\Policies\CategoryPolicy@create');
        Gate::define('category_edit','App\Policies\CategoryPolicy@update');
        Gate::define('category_delete','App\Policies\CategoryPolicy@delete');
    }
    public function defineGateMenu(){
        Gate::define('menu_list','App\Policies\MenuPolicy@view');
        Gate::define('menu_add','App\Policies\MenuPolicy@create');
        Gate::define('menu_edit','App\Policies\MenuPolicy@update');
        Gate::define('menu_delete','App\Policies\MenuPolicy@delete');
    }
    public function defineGateSlider(){
        Gate::define('slider_list','App\Policies\SliderPolicy@view');
        Gate::define('slider_add','App\Policies\SliderPolicy@create');
        Gate::define('slider_edit','App\Policies\SliderPolicy@update');
        Gate::define('slider_delete','App\Policies\SliderPolicy@delete');
    }
    public function defineGateSetting(){
        Gate::define('setting_list','App\Policies\SettingPolicy@view');
        Gate::define('setting_add','App\Policies\SettingPolicy@create');
        Gate::define('setting_edit','App\Policies\SettingPolicy@update');
        Gate::define('setting_delete','App\Policies\SettingPolicy@delete');
    }
    public function defineGateUser(){
        Gate::define('user_list','App\Policies\UserPolicy@view');
        Gate::define('user_add','App\Policies\UserPolicy@create');
        Gate::define('user_edit','App\Policies\UserPolicy@update');
        Gate::define('user_delete','App\Policies\UserPolicy@delete');
    }
    public function defineGateRole(){
        Gate::define('role_list','App\Policies\RolePolicy@view');
        Gate::define('role_add','App\Policies\RolePolicy@create');
        Gate::define('role_edit','App\Policies\RolePolicy@update');
        Gate::define('role_delete','App\Policies\RolePolicy@delete');
    }
    public function defineGateProduct(){
        Gate::define('product_list','App\Policies\ProductPolicy@view');
        Gate::define('product_add','App\Policies\ProductPolicy@create');
        Gate::define('product_edit','App\Policies\ProductPolicy@update');
        Gate::define('product_delete','App\Policies\ProductPolicy@delete');
    }
}

-    Vào ProductPolicy/php

<?php

namespace App\Policies;

use App\User;
use App\Product;
use Illuminate\Auth\Access\HandlesAuthorization;

class ProductPolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can view any products.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function viewAny(User $user)
    {
        //
    }

    /**
     * Determine whether the user can view the product.
     *
     * @param  \App\User  $user
     * @param  \App\Product  $product
     * @return mixed
     */
    public function view(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.list_product'));
    }

    /**
     * Determine whether the user can create products.
     *
     * @param  \App\User  $user
     * @return mixed
     */
    public function create(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.add_product'));
    }

    /**
     * Determine whether the user can update the product.
     *
     * @param  \App\User  $user
     * @param  \App\Product  $product
     * @return mixed
     */

    public function update(User $user,$id)
    {
        $product = Product::find($id);
        if ($user->checkPermissionAccess(config('permissions.access.edit_product')) && $user->id === $product->user_id ){
            return true;
        }
        return false;
    }

    /**
     * Determine whether the user can delete the product.
     *
     * @param  \App\User  $user
     * @param  \App\Product  $product
     * @return mixed
     */
    public function delete(User $user)
    {
        return $user->checkPermissionAccess(config('permissions.access.delete_product'));
    }

    /**
     * Determine whether the user can restore the product.
     *
     * @param  \App\User  $user
     * @param  \App\Product  $product
     * @return mixed
     */
    public function restore(User $user, Product $product)
    {
        //
    }

    /**
     * Determine whether the user can permanently delete the product.
     *
     * @param  \App\User  $user
     * @param  \App\Product  $product
     * @return mixed
     */
    public function forceDelete(User $user, Product $product)
    {
        //
    }
}

-    Giải thích:  khi chạy hàm public function update(User $user,$id)

$product = Product::find($id); lấy id của tài khoản tạo ra sản phẩm.

Kiểm tra điều kiện :

$user->checkPermissionAccess(config('permissions.access.edit_product'))  : Khi tài khoản có vai trò được quyền vào sử dụng edit sản phẩm.

$user->id === $product->user_id : thỏa mãn tài khoản đó phải là tài khoản tạo ra sản phẩm.

=> khi thỏa mãn hai điều kiện trên mới được vào edit sản phẩm đó.

Kiểm tra lại mã nguồn các trang sau:

-    Permission.php

<?php

return[
  'access'=>[
      'list_category'=>'category_list',
      'add_category'=>'category_add',
      'edit_category' => 'category_edit',
      'delete_category' => 'category_delete',

      'list_menu'=>'menu_list',
      'add_menu'=>'menu_add',
      'edit_menu' => 'menu_edit',
      'delete_menu' => 'menu_delete',

      'list_slider'=>'slider_list',
      'add_slider'=>'slider_add',
      'edit_slider' => 'slider_edit',
      'delete_slider' => 'slider_delete',

      'list_setting'=>'setting_list',
      'add_setting'=>'setting_add',
      'edit_setting' => 'setting_edit',
      'delete_setting' => 'setting_delete',

      'list_user'=>'user_list',
      'add_user'=>'user_add',
      'edit_user' => 'user_edit',
      'delete_user' => 'user_delete',

      'list_role'=>'role_list',
      'add_role'=>'role_add',
      'edit_role' => 'role_edit',
      'delete_role' => 'role_delete',

      'list_product'=>'product_list',
      'add_product'=>'product_add',
      'edit_product' => 'product_edit',
      'delete_product' => 'product_delete',
  ],
    'table_module' =>[
        'category',
        'slider',
        'menu',
        'product',
        'setting',
        'user',
        'role'
    ],
    'module_childrent' =>[
        'list',
        'add',
        'edit',
        'delete'
    ]

];

-    web.php

<?php

Route::get('/admin', 'AdminController@loginAdmin');
Route::post('/admin', 'AdminController@postloginAdmin');

Route::get('/home', function () {
    return view('home');
});

Route::prefix('admin')->group(function () {
    //category
    Route::prefix('categories')->group(function () {
        Route::get('/',[
            'as'=> 'categories.index',
            'uses' => 'CategoryController@index',
            'middleware'=>'can:category_list',
        ]);

        Route::get('/create',[
            'as'=> 'categories.create',
            'uses' => 'CategoryController@create',
            'middleware'=>'can:category_add',
        ]);
        Route::post('/store',[
            'as'=> 'categories.store',
            'uses' => 'CategoryController@store'
        ]);
        Route::get('/edit/{id}',[
            'as'=> 'categories.edit',
            'uses' => 'CategoryController@edit',
            'middleware'=>'can:category_edit',
        ]);
        Route::post('/update/{id}',[
            'as'=> 'categories.update',
            'uses' => 'CategoryController@update'
        ]);
        Route::get('/delete/{id}',[
            'as'=> 'categories.delete',
            'uses' => 'CategoryController@delete',
            'middleware'=>'can:category_delete',
        ]);
    });
    //menu
    Route::prefix('menus')->group(function () {
        Route::get('/',[
            'as'=> 'menus.index',
            'uses' => 'MenuController@index',
            'middleware'=>'can:menu_list',
        ]);
        Route::get('/create',[
            'as'=> 'menus.create',
            'uses' => 'MenuController@create',
            'middleware'=>'can:menu_add',
        ]);
        Route::post('/store',[
            'as'=> 'menus.store',
            'uses' => 'MenuController@store'
        ]);
        Route::get('/edit/{id}',[
            'as'=> 'menus.edit',
            'uses' => 'MenuController@edit',
            'middleware'=>'can:menu_edit',
        ]);
        Route::post('/update/{id}',[
            'as'=> 'menus.update',
            'uses' => 'MenuController@update'
        ]);
        Route::get('/delete/{id}',[
            'as'=> 'menus.delete',
            'uses' => 'MenuController@delete',
            'middleware'=>'can:menu_delete',
        ]);
    });

    //Product
    Route::prefix('product')->group(function () {
        Route::get('/',[
            'as'=> 'product.index',
            'uses' => 'AdminProductController@index',
            'middleware'=>'can:product_list',
        ]);
        Route::get('/create',[
            'as'=> 'product.create',
            'uses' => 'AdminProductController@create',
            'middleware'=>'can:product_add',
        ]);
        Route::post('/store',[
            'as'=> 'product.store',
            'uses' => 'AdminProductController@store'
        ]);
        Route::get('/edit/{id}',[
            'as'=> 'product.edit',
            'uses' => 'AdminProductController@edit',
            'middleware'=>'can:product_edit,id',

        ]);
        Route::post('/update/{id}',[
            'as'=> 'product.update',
            'uses' => 'AdminProductController@update'
        ]);
        Route::get('/delete/{id}',[
            'as'=> 'product.delete',
            'uses' => 'AdminProductController@delete',
            'middleware'=>'can:product_delete',
        ]);
    });

    //Slider
    Route::prefix('slider')->group(function () {
        Route::get('/',[
            'as'=> 'slider.index',
            'uses' => 'SliderAdminController@index',
            'middleware'=>'can:slider_list',
        ]);
        Route::get('/create',[
            'as'=> 'slider.create',
            'uses' => 'SliderAdminController@create',
            'middleware'=>'can:slider_add',
        ]);
        Route::post('/store',[
            'as'=> 'slider.store',
            'uses' => 'SliderAdminController@store'
        ]);
        Route::get('/edit/{id}',[
            'as'=> 'slider.edit',
            'uses' => 'SliderAdminController@edit',
            'middleware'=>'can:slider_edit',
        ]);
        Route::post('/update/{id}',[
            'as'=> 'slider.update',
            'uses' => 'SliderAdminController@update'
        ]);
        Route::get('/delete/{id}',[
            'as'=> 'slider.delete',
            'uses' => 'SliderAdminController@delete',
            'middleware'=>'can:slider_delete',
        ]);
    });

    //Settings
    Route::prefix('settings')->group(function () {
        Route::get('/',[
            'as'=> 'settings.index',
            'uses' => 'AdminSettingController@index',
            'middleware'=>'can:setting_list',
        ]);
        Route::get('/create',[
            'as'=> 'settings.create',
            'uses' => 'AdminSettingController@create',
            'middleware'=>'can:setting_add',
        ]);
        Route::post('/store',[
            'as'=> 'settings.store',
            'uses' => 'AdminSettingController@store'
        ]);
        Route::get('/edit/{id}',[
                'as'=> 'settings.edit',
            'uses' => 'AdminSettingController@edit',
            'middleware'=>'can:setting_edit',
        ]);
        Route::post('/update/{id}',[
            'as'=> 'settings.update',
            'uses' => 'AdminSettingController@update'
        ]);
        Route::get('/delete/{id}',[
            'as'=> 'settings.delete',
            'uses' => 'AdminSettingController@delete',
            'middleware'=>'can:setting_delete',
        ]);
    });

    //User
    Route::prefix('users')->group(function () {
        Route::get('/',[
            'as'=> 'users.index',
            'uses' => 'AdminUserController@index',
            'middleware'=>'can:user_list',
        ]);
        Route::get('/create',[
            'as'=> 'users.create',
            'uses' => 'AdminUserController@create',
            'middleware'=>'can:user_add',
        ]);
        Route::post('/store',[
            'as'=> 'users.store',
            'uses' => 'AdminUserController@store'
        ]);
        Route::get('/edit/{id}',[
            'as'=> 'users.edit',
            'uses' => 'AdminUserController@edit',
            'middleware'=>'can:user_edit',
        ]);
        Route::post('/update/{id}',[
            'as'=> 'users.update',
            'uses' => 'AdminUserController@update'
        ]);
        Route::get('/delete/{id}',[
            'as'=> 'users.delete',
            'uses' => 'AdminUserController@delete',
            'middleware'=>'can:user_delete',
        ]);
    });

    //Role
    Route::prefix('roles')->group(function () {
        Route::get('/',[
            'as'=> 'roles.index',
            'uses' => 'AdminRoleController@index',
            'middleware'=>'can:role_list',
        ]);
        Route::get('/create',[
            'as'=> 'roles.create',
            'uses' => 'AdminRoleController@create',
            'middleware'=>'can:role_add',
        ]);
        Route::post('/store',[
            'as'=> 'roles.store',
            'uses' => 'AdminRoleController@store'
        ]);
        Route::get('/edit/{id}',[
            'as'=> 'roles.edit',
            'uses' => 'AdminRoleController@edit',
            'middleware'=>'can:role_edit',
        ]);
        Route::post('/update/{id}',[
            'as'=> 'roles.update',
            'uses' => 'AdminRoleController@update'
        ]);
        Route::get('/delete/{id}',[
            'as'=> 'roles.delete',
            'uses' => 'AdminRoleController@delete',
            'middleware'=>'can:role_delete',
        ]);
    });

    //Permissions
    Route::prefix('permissions')->group(function () {
        Route::get('/create',[
            'as'=> 'permissions.create',
            'uses' => 'AdminPremissionController@createPermissions'
        ]);
        Route::post('/store',[
            'as'=> 'permissions.store',
            'uses' => 'AdminPremissionController@store'
        ]);

    });
});