Can't protect Routes based on role Laravel 8 - laravel

Question

I'm trying to use middlewares to protect Routes based on role.
Im testing with this route to allow only the role administrador to be able to enter it.
Route::get('/gestionarMedicos', [PersonaController::class,'mostrarMedicos'])->name('personaMostrarMedicos')->middleware('auth','firstLogin','role:administrador');
This is code of my middleware (in the route its the one called route)
<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
class EnsureUserHasRole
{
/**
* Handle an incoming request.
*
* #param \Illuminate\Http\Request $request
* #param \Closure $next
* #return mixed
*/
public function handle(Request $request, Closure $next, $role)
{
if (! $request->user()->hasRole($role)) {
// Redirect...
return back();
}
return $next($request);
}
}
This is the code of the User model
<?php
namespace App\Models;
use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Database\Eloquent\Model;
class User extends Authenticatable
{
use HasFactory, Notifiable;
/**
* The attributes that are mass assignable.
*
* #var array
*/
protected $fillable = [
'role',
'name',
'email',
'password',
'idPersona',
'estado'
];
public function Persona(){
return $this->belongsTo(Persona::class,'idPersona');
}
/**
* The attributes that should be hidden for arrays.
*
* #var array
*/
protected $hidden = [
'remember_token'
];
/**
* The attributes that should be cast to native types.
*
* #var array
*/
protected $casts = [
'email_verified_at' => 'datetime',
];
public function hasRole($role)
{
return User::where('role', $role)->get();
}
}
Some logic is not done right because I can access the Route even with users that doesn't have that role
The dd() in the middleware was for testing, I get "administrador" with it.
I have tried Patrick Obafemi solution but I still have the same problem.
For testing I did a dd of what the if based on Patrcik answer result is and it is false.
I'm not sure where is the logic problem.
I'm also going to post a picture of my database model if it helps in some way.

Answer 1

The question is answered in the link below.
Middleware doesn't protect routes based on role
It also covers how to protect routes in the case you need to do it for multiple roles. The condition is wrong because it gives a collection of the users that have the role administrador. The condition should be like this to only allow a desired role to access the Route
if (!$request->user() || $request->user()->role != $role) {
// Redirect...
return back();
}
For multiple roles you can visit the link where the answer explains how to allow multiple desired roles to access the Route.
Maybe Patrick answer is right but question was also answered here.

Answer 2

I think your error is coming from your hasRole in your User Model. The result user() already has access to your user model so you can just make it a local scope. What you are doing now in your middleware will return something like this. So using the get function will return a collection of users but to check if that user exists you should use first() or better still exists(). Also you cannot call where on a single model entity and that's what $request->user()->role() is trying to do
User::User::where('role', $role)->get();
Try this instead
<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
class EnsureUserHasRole
{
/**
* Handle an incoming request.
*
* #param \Illuminate\Http\Request $request
* #param \Closure $next
* #return mixed
*/
public function handle(Request $request, Closure $next, $role)
{
$id = $request->user()->id;
if (!User::where([['id', $id],['role',$role]])->exists()) {
// Redirect...
return back();
}
return $next($request);
}
}
Then your model will look like this
<?php
namespace App\Models;
use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Database\Eloquent\Model;
class User extends Authenticatable
{
use HasFactory, Notifiable;
/**
* The attributes that are mass assignable.
*
* #var array
*/
protected $fillable = [
'role',
'name',
'email',
'password',
'idPersona',
'estado'
];
public function Persona(){
return $this->belongsTo(Persona::class,'idPersona');
}
/**
* The attributes that should be hidden for arrays.
*
* #var array
*/
protected $hidden = [
'remember_token'
];
/**
* The attributes that should be cast to native types.
*
* #var array
*/
protected $casts = [
'email_verified_at' => 'datetime',
];
public function scopeRole($query, $role)
{
return $query->where('role', $role);
}
}

Answer 3

even your class diagram has a problem. if there are roles then there should be an inheritance. already how do you materialize this here. in short the solution is to make a gates or a policies or a middleware. i have an example of middleware but just for the verification if a user is admin.
class VerifyIsAdmin
{
public function handle($request, Closure $next)
{
$user = $request->user();
if ($user && $user->role === 'admin') {
return $next($request);
}
return abort(403);
}
}
this concerns the verifyIsAdmin middleware. then you go to
APP/Http/Kernel
then paste
protected $routeMiddleware = [
'admin' => VerifyIsAdmin::class,
];
and add the following line in the namespace
use App\Http\Middleware\VerifyIsAdmin;
and add to the route group
Route::middleware(['admin'])->group(function () {