Laravel - How to exclude a particular endpoint from from role permission - laravel

Question

I am using using Laravel Spatie for User Permission for my api. The version is Laravel-5.8.
OrderController
<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use App\Order;
use App\User;
use App\Student;
use App\Guardian;
class OrderController extends Controller
{
public function index(Request $request)
{
if(!Auth::user()->hasPermissionTo('View Order'))
return response()->json([ "message" => 'User do not have permission'], 401);
return response()->json(::with('order_detail')->get(), 200);
}
public function store(Request $request)
{
if(!Auth::user()->hasPermissionTo('Add Order'))
return response()->json([ "message" => 'User do not have permission'], 401);
$request->validate([
'week_day' => 'required|integer',
'start' => 'required',
'end' => 'required',
'amount' => 'required',
'full_name' => 'required'
]);
$orders = Order::create($request->all());
return json_encode($orders);
}
public function show($id)
{
if(!Auth::user()->hasPermissionTo('View Order'))
return response()->json([ "message" => 'User do not have permission'], 401);
return json_encode(Order::findOrFail($id));
}
}
api.php
Route::group([
'middleware' => 'auth:api'
], function () {
Route::get('order/mobile', 'OrderController#mobile');
Route::resource('order', 'OrderController', ['only' => ['index', 'show', 'store', 'update', 'destroy']]);
});
I want anyone that get to the site to be able to create, store and send order without the need to login. However, permission is needed for index, update and delete. There should not be permission for that. How do I adjust my controller and api.php to achieve this expected result to create and store order?

Answer 1

auth middleware on your route group is preventing all unauthenticated users from accessing them. You can either remove the middleware or create two groups where index, update, and delete is under auth middleware and the second group without auth for other routes.
If you remove the middleware from the route group you can add it to specific methods in your controller like so
public function __construct()
{
$this->middleware('auth')->only(['index', 'update', 'destroy']);
}
and of cource you can also specify spatie middleware
public function __construct()
{
$this->middleware('role:Contributor')->only(['index', 'update', 'destroy']);
}
However, you can also manualy test within your controller methods for various user permissiosn
if ($user->hasRole('Contributor')){};
This way you can allow unauthenticated users to perform some actions but restrict some actions to auth users.