This is more a question then a issue.

When implementing the acl. How would you go about managing this. If I make a admin page that manages the permissions. How would the database know witch permissions have been implemented into the routes file, and for that matter in the code?

Also if I make use of Roles in routes, then how are these roles translated into actual permission sets in the database?

In my mind if I implement either a role or a user permission in the routes file or anywhere else, this should some how be available to me in the interface, so that it is not necessary to implement the roles "by memory". Would this some how be possible?

This error appeared after doing composer update today, currently running Laravel 5.0.33.

I managed to find the block of code at fault, lines 64 to 81 in AclServiceProvider.php, as copied below. Commenting it out temporarily fixed the problem but I'm unsure about a permanent solution (not even sure why this has suddenly appeared).

        // role
        Blade::directive('role', function($expression) {
            return "<?php if (Auth::check() && Auth::user()->is{$expression}): ?>";
        });

        Blade::directive('endrole', function() {
            return "<?php endif; ?>";
        });

        // permission
        Blade::directive('permission', function($expression) {
            return "<?php if (Auth::check() && Auth::user()->can{$expression}): ?>";
        });

        Blade::directive('endpermission', function() {
            return "<?php endif; ?>";
        });

Hi, is it possible to assign only specific permissions to roles?

According to the wiki it's possible to do this by following line:

$roleAdmin->assignPermission('user');

But in my case I want my roles to only have something like this:

$roleUser->assignPermission('view.user');
$roleModerator->assignPermission(['view.user', 'update.user']);
$roleAdmin->assignPermission('user');

So is this possible with the code above or is it a feature that has to be implemented?

Regards, Stefan

I have a question guys, maybe you could help me. My question is how can I protect the routes if I have two different kinds of roles? For example I have an administrator and a supervisor. How can I Implement it in my routes.php?

Privileges for all roles in User route: administrator: ALL supervisor: READ, UPDATE, CREATE (NO DELETE)

I have this in my administrator Route::group([ 'prefix' => 'api', 'middleware' => ['jwt.auth', 'acl'], 'is' => 'administrator' ], function () { Route::post('user/create', 'UserController@store'); Route::get('user', 'UserController@index'); Route::get('user/{user}', 'UserController@show'); Route::put('user/{user}', 'UserController@update'); Route::delete('user/{user}', 'UserController@destroy'); } );

Do I need to create another route for a supervisor and just remove the delete route? Like this? Route::group([ 'prefix' => 'api', 'middleware' => ['jwt.auth', 'acl'], 'is' => 'supervisor' ], function () { Route::post('user/create', 'UserController@store'); Route::get('user', 'UserController@index'); Route::get('user/{user}', 'UserController@show'); Route::put('user/{user}', 'UserController@update'); } );

I do hope you could give me some tips and suggestions with regards to my problem. Thanks.

In Wiki i found the following rules about user permissions

1. getPermissions : Get permissions assigned to a user, all user permissions along with its role permissions.
2. user permissions override role ones.

But I dont get them as result. Please refer this image

http://snag.gy/Eyc6Y.jpg

Please check.

solves #149

Changes

• Renamed HasRole::is() to HasRole::hasRole() due to conflicts with new method Model::is() in Eloquent
• Corrected all Blade directives to handle change in $expression parameter passing (no more brackets included).
• Using Collection::pluck instead of Collection::lists(), if the method exists.
• Preserved compatibility with older Laravel versions.

Testing:

I updated the complete library, but only did functional testing on Laravel 5.3 with the hasRole trait, because that's the only one we use for now. For the other changes I only did an automated syntax and a thorough visual check.

I am quite confident that nothing broke, but if someone can test the other Traits and/or on prior Laravel versions, that would be appreciated.

I'm currently working with Laravel v.5.0, and I have an error in the HasRole.php since this https://github.com/kodeine/laravel-acl/commit/8e5bcd4e0befdf9de6e5de498a613510e4873168 update.

FatalErrorException in HasRole.php line 35: Call to a member function all() on array

The lists() method still returns an array in v.5.0 whilst it no longer returns an array in v.5.1.

Could you make it compatible?

Greetings and thanks for your work on this package.

I just spent the last couple hours trying to figure out why the permissions inheritance was not working as per your example in the wiki. Alas, it was the 'ntfs' setting in the config file.

I suggested an edit on the Wiki page to inform the reader that the example will not work as expected if the default value of true is left unchanged.

Do you believe it is a more common desire to have the default behavior of "more permissive wins"? I would think not, but I have not implemented many ACL systems, so perhaps this is my ignorance.

Problem

I have just noticed something that doesn't look quite right to me, i have the following situation: An user has two roles: student and secretary both have a different kind of permission regarding users obtained via permission inheritance:

$genericUser=Permission::create([
            'name' => 'users',
            'slug' => [
                'create' => false,
                'view' => true,
                'update' => false,
                'approve' => false,
                'delete' => false,
            ],
            'description' => 'generic permission regarding users'
        ]);
        $secretaryUser = Permission::create([
            'name' => 'users.secretary',
            'slug' => [
                'create' => true,
                'edit' => true,
                'approve' => true,
                'delete' => true,
            ],
            'inherit_id' => $genericUser->getKey(),
            'description' => 'secretary permission regarding users'
        ]);

Since the user has both roles, it has both the permission users and users.secretary. The problem is that when i call can('edit.users') it returns false, if i call $user->getPermissions() i get the permissions of the last role assigned to the user (if i assign the generic first, i get the permissions of the secretary and vice versa).

Where the issue is

I think that depends on the fact that the method 'can' in 'HasPermission' trait calls the method 'getPermissions' which uses an array_replace_recursive, which replaces the permission set with the latest extracted from the database and not the higher in clearance

Proposal

When the user has more roles, each one with a different permission regarding the same thing, they should be merged granting the highest level of clearence, for example

User has role1 and role2
role1 has permission1:
'name' => 'generic'
 'slug' => [
                'create' => true,
                'edit' => false,
            ],
role2 has permission2:
'name' => 'generic'
 'slug' => [
                'create' => false,
                'edit' => true,
            ],

Calling getPermissions() on him should return

"users"=>array:2[
"create"=>"true"
"edit"=>"true"
]

Workaround

array_replace_recursive overwrites everything previously existing, even if this means loosing some clearence, to avoid that we need to check for every key that it's value is higher than the one we currently have, i can't find any fancy function in PHP to do this:

foreach($this->roles as $role){
  foreach($role->getPermissions() as $slug=>$array){
    if(array_key_exists($slug,$permissions){
      foreach($array as $clearence=>$value){
       !$value?:$permissions[$slug][$clearance]=true;
     }
   }else{
      $permissions = array_merge($permissions,array($slug => $array));
   }
 }
}

It's quite an ugly piece of code and i'm sorry for that, maybe you can come up with something better. Sorry for my horrible english

Hello,

When I want to create a new permission with the example in the wiki, I'm getting this error: ErrorException in helpers.php line 686: preg_replace(): Parameter mismatch, pattern is a string while replacement is an array.

Is this my mistake or an issue in the code?

Thanks!

Example: $permission = new Permission(); $permUser = $permission->create([ 'name' => 'user', 'slug' => [ 'create' => true, 'view' => true, 'update' => true, 'delete' => true, 'view.phone' => true ], 'description' => 'manage user permissions' ]);

In order to purge only ACL cached entries, use the tags() method on the Cache facade. This way it is possible to purge only the ACL entries.

This functionality can be helpful when editing ACLs using an interface.

This fixes handling of a different guard other than application default.

Fixes: #135.

• Guard parameter on config file to get default;

  /**
   * Guard
   * Set the guard for user validations.
   */
  'guard' => config('auth.defaults.guard'),

• Added guard on HasPermission handle;

   $this->guard = config('acl.guard');

• Added $guard = $this->guard on hasRole, hasPermission and protectMethods;

• Changed $request->user() to $request->user($guard) on hasRole, hasPermission and protectMethods;

• Changed Blade directives to Blade::if method and guard added;

   // role
   Blade::if('role', function ($expression) {
        return Auth::guard(config('acl.guard'))->check() && Auth::guard(config('acl.guard'))->user()->hasRole($expression);
   });

   // permission
   Blade::if('permission', function ($expression) {
        return Auth::guard(config('acl.guard'))->check() && Auth::guard(config('acl.guard'))->user()->hasPermission($expression);
   });

By default this package has set cache time for 1 minute. If I update permissions for a role, this will be effective in next cache interval. But there's should be an option to manually invalidate the cache.

I'm talking about JSON output/print When cache is active, it return like the following for $role->getPermissions()

{
     role_name: {
         update: true
     },
     ...
}

but after the cache time exceeds, 1st response returns whole result set like:

[
	{
		"id":2,
		"inherit_id":null,
		"name":"role_name",
		"slug":{
			"update":true
		},
		"description":"Post can be edited",
		"created_at":"2021-03-03T12:02:43.000000Z",
		"updated_at":"2021-03-03T12:02:43.000000Z",
		"pivot":{
			...
		}
	},
	...
]

In config file I've 'cacheMinutes' => 1 & I get this type of data change every 1 minute. Hope this explanation will be enough to reproduce the issue.

This makes working with this hard.

I tried to use the cache feature and would like to clear the existing permissions when ever role is updated. but couldn't find anything related to this in docs.

I just dig into the code and found that cache tags were available in ver 1.0 but not in v 2.0. any plan to incorporate this feature to 2.0 branch?

I'm using laravel 6 and laravel-acl 2.0.

Sometimes standard migrations need to be tweaked a bit. For example, when the user's id is not numeric, but uuid, ulid. Then a different ID format is used. It is good to have all migrations in one database/migrations folder.

Tested, everything works