Best way to check if user 'owns' another user - laravel

Question

I have implemented a system in Laravel where a user can be a manager of multiple 'stores'. A store can have multiple users belonging to that store. Here's my stripped down table structure -
users
id (int)
name (string)
email (string)
user_stores
user_id (int)
store_id (int)
manager (boolean/tinyint)
stores
id (int)
name (string)
My issue is checking who a user with a manager pivot flag can manage. I have a solution but I'm not sure it's optimal. I want the query to be as lean as possible. Here is my current solution -
protected $manageable_users;
public function getManageableUserIds () {
if(!is_array($this->manageable_users)) {
// get our store id's that we manage
$manages = DB::table('user_stores')
->where('user_id', $this->id)
->where('manager', true)
->select('store_id');
// make a join so we can get our data
$this->manageable_users = DB::table('user_stores AS d2')
->joinSub($manages, 'stores', function ($join) {
$join->on('d2.store_id', '=', 'stores.dealership_id');
})->distinct()->pluck('d2.user_id')->toArray();
}
return $this->manageable_users;
}
So what I'm doing here is grabbing an array of all user ID's that the manager can possibly manage. I then store this as a protected variable so that on the same request I can perform this check multiple times within the same request without making multiple queries.
I then have a separate method called canManage which checks if the current user object can actually manage the passed user -
public function canManage(User $user) {
// check if our user is manageable
return in_array($user->id, $this->getManageableUserIds(), true);
}
Now I know Laravel is super smart and for some reason I feel like this isn't the best solution.. plus I don't want it to be too intensive on the database as ultimately there will be a lot of users and stores on this system.
If nothing else, maybe this could be a solution for someone else!
Thanks.

Answer 1

So basically you wanted to build a pivot relation. Here is how you could do it relative to your case:
app/User.php
<?php
namespace App;
use Illuminate\Database\Eloquent\Model;
class User extends Model {
public $table = 'user';
protected $primaryKey 'id';
protected $foreignKey = 'user_id';
public function stores() {
return $this->belongsToMany('App\Store', 'user_stores', 'user_id', 'store_id')->withPivot('manager');
}
}
?>
app/Store.php
<?php
namespace App;
use Illuminate\Database\Eloquent\Model;
use App\Store;
class Store extends Model {
public $table = 'store';
protected $primaryKey 'id';
protected $foreignKey = 'store_id';
public function users() {
return $this->belongsToMany('App\User', 'user_stores', 'store_id', 'user_id')->withPivot('manager');
}
}
?>
Now, let us say you know in advance user with id 4 is a manager, and you want to get all the users this manager can manage.
I will asume we are in a controller because most of the time this is the place where all your business logic is located, so you are browsing route /user/4/store/1, and we will display a list of all the users this user(manager) manages.
I also add the store (1) in the route to make it clear we want all users from this store, because your model does not forbid a manager to manage multiples stores. Right after the version assuming a manager only manages one store.
app/Http/Controllers/UserStoreController.php
<?php
namespace App\Http\Controllers;
use App\User;
use App\Http\Controllers\Controller;
class UserStoreController extends Controller {
public function show(User $user, Store $store) {
// Grab all the users that are in the store and that are not manager
$managed_users = User::whereHas('stores', function($query) use($store) {
$query->where('manager', false)->where('store_id', $store->id);
})->get();
return view('user.store.index')
->withStore($store)
->withUser($user)
->withManagedUsers($managed_users);
}
}
(Note, accessing a route with an id let us use the power of Model injection, that is why I do not put public function show($user_id, $store_id), because Laravel will automatically use User::find($user_id) and Store::find($store_id) for us).
Version assuming a manager can manage only one store:
app/Http/Controllers/UserController.php
<?php
namespace App\Http\Controllers;
use App\User;
use App\Store;
use App\Http\Controllers\Controller;
class UserController extends Controller {
public function show(User $user) {
// We find the related store
$store = $user->stores->first();
// Same thing, we grab all users that are managed
$managed_users = User::whereHas('stores', function($query) use($store) {
$query->where('manager', false)->where('store_id', $store->id);
})->get();
return view('user.index')
->withUser($user)
->withManagedUsers($managed_users);
}
}
Hope it helps.

Answer 2

Here's a raw SQL solution:
SELECT
a.userid FROM user_stores a
INNER JOIN
user_stores b ON a.store_id = b.store_id
WHERE
a.manager=0 AND b.manager=1;
To convert this to eloquent, might try DB::select and/or DB::raw
Database table views are also worth considering. Then you'd just query your view to get your custom tailored results instead of the table directly. This kind of solution promotes clean code, allows you to continue using the ORM, doesn't require you to resort to running raw SQL in your application and gives you all the speed benefits of having this done as raw SQL. The main down side is having to write such a view and make sure it's maintained. Pretty much the same drawbacks as using triggers.
Another idea is just pull the whole database in one shot through the ORM, then use laravel collections to filter the data. In this case I'd probably reach for reduce. Could also pipeline it with filter or anything else on the list. Sure this is extra looping, but in comparison to the ORM, is it really that bad of a performance trade off?
Finally, it's also worth considering the solution of "whatever works and is most readable" and then simply cache it using, for example, redis.