Implement robust laravel authorization logic without writing a single line of code
This package helps you to quickly create strong policy authorization logic in your Laravel application with minimal effort. In most cases the defaults will be just enough and all you'd need to do is authorize.
Installation
You can install the package via composer:
composer require flixtechs-labs/laravel-authorizer
You can publish the config file with:
php artisan vendor:publish --tag="laravel-authorizer-config"
This is the contents of the published config file:
return [
'permissions' => [
'create',
'update',
'delete',
'view all',
'view',
'force delete',
'restore',
],
];
Setup
This package depends on the spatie/laravel-permission package. It's installed automatically when you install this package.
To setup the package all you need to is run the following command:
php artisan authorizer:setup
If your project is ready you can generate the permissions on setup by adding the --permissions option:
php artisan authorizer:setup --permissions
You can also generate the policies on setup by adding the --policies option:
php artisan authorizer:setup --policies
Or you can generate both on setup by adding the --permissions and --policies options:
php artisan authorizer:setup --permissions --policies
This will publish the migrations from the spatie/laravel-permission package, migrate the database and generate the permissions and policies.
Usage
This package generates a batteries included policy skeleton. You just have to generate a policy and authorize in your controllers.
Generate a policy for one model
php artisan authorizer:policies:generate Post --model=Post
This will generate a PostPolicy in the App\Policies\ namespace. The generated Policy would look something like this:
<?php
namespace App\Policies;
use App\Enums\PostState;
use App\Models\Post;
use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;
use Illuminate\Auth\Access\Response;
class PostPolicy
{
use HandlesAuthorization;
/**
* Determine whether the user can view any models.
*
* @param User $user
* @return Response|bool
*/
public function viewAny(User $user): Response|bool
{
return $user->can('view all posts');
}
/**
* Determine whether the user can view the model.
*
* @param User|null $user
* @param Post $post
* @return Response|bool
*/
public function view(?User $user, Post $post): Response|bool
{
return $user->can('view post')
}
/**
* Determine whether the user can create models.
*
* @param User $user
* @return Response|bool
*/
public function create(User $user): Response|bool
{
return $user->can('create post');
}
/**
* Determine whether the user can update the model.
*
* @param User $user
* @param Post $post
* @return Response|bool
*/
public function update(User $user, Post $post): Response|bool
{
return $user->can('update post');
}
/**
* Determine whether the user can delete the model.
*
* @param User $user
* @param Post $post
* @return Response|bool
*/
public function delete(User $user, Post $post): Response|bool
{
return $user->can('delete post');
}
/**
* Determine whether the user can restore the model.
*
* @param User $user
* @param Post $post
* @return Response|bool
*/
public function restore(User $user, Post $post): Response|bool
{
return $user->can('restore post');
}
/**
* Determine whether the user can permanently delete the model.
*
* @param User $user
* @param Post $post
* @return Response|bool
*/
public function forceDelete(User $user, Post $post): Response|bool
{
return $user->can('force delete post');
}
}
Now all you just need to do is authorize the user in your controllers:
<?php
namespace App\Controllers;
use App\Models\Post;
public function __construct()
{
$this->authorizeResource(Post::class, 'post');
}
Or authorize per action
public function update(UpdatePostRequest $request, Post $post)
{
$this->authorize('update', $post);
}
Generating policies for all models
php artisan authorizer:policies:generate
This will generate policies for all models in your project.
Generating permissions for one model
php artisan authorizer:permissions:generate --model=Post
This will generate all the CRUD permissions for one specific model. You can add additional permission to be generated by adding them to the config file in config/authorizer.php
Or you can just generate for all the models
php artisan authorizer:generate:permissions
Testing
composer test
Changelog
Please see CHANGELOG for more information on what has changed recently.
Contributing
Please see CONTRIBUTING for details.
Security Vulnerabilities
Please review our security policy on how to report security vulnerabilities.
Credits
License
The MIT License (MIT). Please see License File for more information.
80 Oct 21, 2022
240 Oct 26, 2022
9 Dec 21, 2022
3 Mar 5, 2022
2 Oct 2, 2022
5 Jun 13, 2022
307 Sep 23, 2022
2 Feb 16, 2022
5 Oct 15, 2021
28 Dec 19, 2022
4 Nov 24, 2022
1 Nov 20, 2021
48 Nov 29, 2022
330 Dec 8, 2022
139 Dec 27, 2022
3.1k Nov 25, 2022
68 Dec 12, 2022
88 Dec 31, 2022
15 Feb 17, 2022