Laravel does not have a built-in role permission system, but it can be implemented through Gates, Policies and database drivers; 2. It is necessary to create Role and Permission models and migrations, and establish role_user and permission_role intermediate table associations; 3. Define many-to-many relationships and permission checking methods in the User, Role, and Permission models; 4. Create CheckPermission middleware and register in Kernel for routing permission control; 5. Use Gate to define fine permissions in AuthServiceProvider; 6. It is recommended to use the Spatie/laravel-permission package to simplify development, which supports role allocation, permission granting and middleware protection, and is suitable for medium and large projects; 7. Simple applications can be implemented manually, and it is recommended to use the Spatie package to save time and obtain stable functions in complex systems. The final plan should be selected based on project complexity and development cycle.

Implementing user roles and permissions in Laravel is a common requirement for applications that need access control. While Laravel doesn't include a built-in roles and permissions system, it provides tools like Gates and Policies that make it easy to build one. Here's a practical way to implement roles and permissions using a database-driven approach.

1. Set Up Roles and Permissions Tables

First, create models and migrations for Role and Permission , and a pivot table to link them to users.

 php artisan make:model Role -m
php artisan make:model Permission -m

In the create_roles_table migration:

 Schema::create('roles', function (Blueprint $table) {
    $table->id();
    $table->string('name')->unique();
    $table->string('slug')->unique();
    $table->timestamps();
});

In the create_permissions_table migration:

 Schema::create('permissions', function (Blueprint $table) {
    $table->id();
    $table->string('name')->unique();
    $table->string('slug')->unique();
    $table->timestamps();
});

Now create a pivot table for role_user and permission_role :

 php artisan make:migration create_role_user_table
php artisan make:migration create_permission_role_table

In create_role_user_table :

 Schema::create('role_user', function (Blueprint $table) {
    $table->unsignedBigInteger('role_id');
    $table->unsignedBigInteger('user_id');
    $table->foreign('role_id')->references('id')->on('roles')->onDelete('cascade');
    $table->foreign('user_id')->references('id')->on('users')->onDelete('cascade');
    $table->primary(['role_id', 'user_id']);
});

In create_permission_role_table :

 Schema::create('permission_role', function (Blueprint $table) {
    $table->unsignedBigInteger('permission_id');
    $table->unsignedBigInteger('role_id');
    $table->foreign('permission_id')->references('id')->on('permissions')->onDelete('cascade');
    $table->foreign('role_id')->references('id')->on('roles')->onDelete('cascade');
    $table->primary(['permission_id', 'role_id']);
});

Run the migrations:

 php artisan migrate

2. Define Relationships in Models

In User.php :

 public function roles()
{
    return $this->belongsToMany(Role::class);
}

public function hasRole($role)
{
    if (is_string($role)) {
        return $this->roles->contains('slug', $role);
    }

    return !! $role->intersect($this->roles)->count();
}

public function hasPermissionTo($permission)
{
    return $this->hasPermissionThroughRole($permission) || $this->hasDirectPermission($permission);
}

protected function hasPermissionThroughRole($permission)
{
    return $this->hasRole($this->getPermissionsViaRoles()->pluck('slug')->contains($permission));
}

protected function hasDirectPermission($permission)
{
    return $this->permissions->contains('slug', $permission);
}

In Role.php :

 protected $fillable = ['name', 'slug'];

public function permissions()
{
    return $this->belongsToMany(Permission::class);
}

public function users()
{
    return $this->belongsToMany(User::class);
}

In Permission.php :

 protected $fillable = ['name', 'slug'];

public function roles()
{
    return $this->belongsToMany(Role::class);
}

You may also want a permissions relationship directly on User if you allow direct permissions.

3. Create Middleware for Route Protection

Create a middleware to check permissions:

 php artisan make:middleware CheckPermission

In CheckPermission.php :

 public function handle($request, Closure $next, $permission)
{
    if (! auth()->check()) {
        return redirect('login');
    }

    if (! auth()->user()->hasPermissionTo($permission)) {
        abort(403, 'You do not have permission to access this.');
    }

    return $next($request);
}

Register the middleware in app/Http/Kernel.php :

 protected $routeMiddleware = [
    // ...
    'permission' => \App\Http\Middleware\CheckPermission::class,
];

Use it in routes:

 Route::get('/admin', function () {
    //
})->middleware('permission:access-admin-panel');

4. Use Gates for Fine-Grained Control

You can define Gates in AuthServiceProvider.php :

 Gate::define('edit-posts', function ($user) {
    return $user->hasPermissionTo('edit-posts');
});

Then in Blade or controllers:

 @can('edit-posts')
    <button>Edit</button>
@endcan

Or in controller:

 if (Gate::allows('edit-posts')) {
    // Allow action
}

5. Optional: Use a Package (eg, Spatie Laravel-Permission)

Instead of building from scratch, many developers use the popular spatie/laravel-permission package.

Install it:

 composer requires spatie/laravel-permission

Publish and run migrations:

 php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"
php artisan migrate

Then use it:

 use Spatie\Permission\Models\Role;
use Spatie\Permission\Models\Permission;

// Create roles and permissions
Permission::create(['name' => 'edit posts']);
Role::create(['name' => 'editor']);

$role = Role::findByName('editor');
$role->givePermissionTo('edit posts');

$user = User::find(1);
$user->assignRole('editor');

Protect routes:

 Route::get('/edit', function () {
    //
})->middleware('permission:edit posts');

Summary

You can implement roles and permissions in Laravel either manually using relationships and middleware or use a robust package like spatie/laravel-permission for faster, cleaner implementation. The manual approach gives full control, while the package saves time and include tested features like caching and Blade directives.

For most projects, especially mid to large scale, the Spatie package is recommended. For simple apps with only a few roles, Gates and basic role checks might be enough.

Basically, pick the method that fits your app's complexity and timeline.

The above is the detailed content of How to implement user roles and permissions in Laravel?. For more information, please follow other related articles on the PHP Chinese website!