What is the best practice to tell to fronted app which Laravel routes are allowed for user roles? [closed] - laravel

Question

Closed. This question is opinion-based. It is not currently accepting answers.
Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.
Closed 3 days ago.
Improve this question
I have a back-end application in Laravel 9 and another front-end application in React.
In back-end application there are multiple user roles and permissions created and, for each route in routes/api.php file, is added a middleware to specify the permission.
Note: Multiple roles can be assigned to a permission.
Example:
Route::get('countries', [CountriesController::class, 'index'])->middleware( ['permission:view-countries']);
So In this case only users with roles which are assigned to permission view-countries can access the route /api/countries.
Front-end application has buttons or links and requests to Laravel are made when clicking on them. I need to know if logged in user on front-end have access to those requests before making the requests in order to show or not the buttons or links. I'm thinking to send a list of routes to the front-end, after log in, which are available for that user. Maybe another solution?

Answer 1

there is no standard way of doing what you are asking, this solely rely on your setup, data, and environment. like how many permission you have, how many routes will be part of the conditional buttons etc.
The easier approach you can do is simply grab the user role/permission when fetching the user from initial request, you store that user data somehwere inside your front-end app, then check the data for displaying those buttons or not.
If you want to grab all the routes avaible for permission based middleware, you can use Route::getRoutes() and filter them based on the middleware you pass.
here's an example which you can improve
//Get all permission of current user
$userPermissions = $request->user()->permissions;
// format them like the route middleware
$permissionsMiddleware = collect($userPermissions)->map( fn($item) => 'permission:'.$item )->toArray();
//should look like
// ['permission:permission1', 'permission:permission2', 'permission:view-countries']
//Grab all the Routes by route name
$allRoutes = collect( Route::getRoutes()->getRoutesByName() );
$userAllowedRoutes = $allRoutes
// format the data to only have middleware, path and name
->map( fn($route, $key) => [
'middleware' => $route->gatherMiddleware(),
'path' => $route->uri,
'name' => $key
])
// filter to only return routes that has middleware present on $permissionMiddleware
->filter( fn( $route ) => array_intersect( $permissionMiddleware, $route['middleware'] ) )
//remove the collection key
->values();