How to define multilevel Authentication in laravel 5.3
In this project many role
Owner
Admin
employe
end user
I need Full project of laravel 5.3 authentication any one send me code
email id : tukadiyarameshr#gmail.com
Please refer to the documentation for Polymorphic relations given in the documentation and the answer given here. The answer will help you understand how to make the relations & create the users.
Once, you have understood how Polymorphic relations work... Understand this that Authentication will happen using the User table only (by email and password), but you can verify if the user is Admin, Owner or Employee in the following manner
public function checkUserRole() {
if(auth()->user()->profile_type == 'App\Models\Admin') {
return 'admin';
} else if(auth()->user()->profile_type == 'App\Models\Owner') {
return 'owner';
} else {
return 'employee';
};
}
Also, to handle user's page flow, you will have to create Middlewares and assign them to their respective routes, so no one can access the views which are not meant for them.
Have u tried like in version 5.2? it will help:
How to use multi Auth in laravel 5.2
i'm not sure if it works in 5.3 but it doesn't looks different
Related
I am very new into programming and trying to make some work on Laravel / Voyager.
I have a Customers table and on this table there is also Customer_Representative field where I can select / assign customer representatives from dropdown list.
What I am trying to achieve is I want each users with their assigned roles (Customer Representative) to list customers only assigned for them.
I am using this below code, but I am not able to see list of customers that other users created. I can only see the customers I / Admin created but If I login with their details I can see their assigned customers.
So as an admin I want to be able to see all customers, so I can also edit them with my login credentials.
public function scopeCurrentUser($query)
{
return $query->where('Customer_Representative', Auth::user()->id);
}
I saw many suggested to use if but I couldn't figure out how to do it.
Appreciate your supports !
If I understand correctly, you want to display:
admin users - all users
non-admin users - only assigned users
You can either change the query in controller, but if you want to do it in scope I suggest something like this:
public function scopeCurrentUser($query)
{
return $query->when(auth()->user()->is_not_admin, function ($q) {
$q->where('Customer_Representative', auth()->user()->id)
});
}
You change the auth()->user()->is_not_admin to your condition for non-admin validation. The scope utilizes the ->when() function to append the condition to query only if the condition (in this case if authenticated user is not an admin) is true.
So if authenticated user is not an admin, his query will be filtered by Customer_Representative.
I have an api that I am implementing multi-tenant based on an additional column in the tables.
For this I created a trait that implements a
static::addGlobalScope() and static::creating().
I have a user_idXtenant_id table. In this table I store the accesses that the user has.
My Route looks like this:
Route::get('{tenant_id}/products', function ($tenant_id) {
return App\Products::where(['tenant_id' => $tenant_id])->get();
})->middleware('role_or_permission:admin|seller|get-products');
Route::get('products', function () {
return App\Products::get();
})->middleware('role_or_permission:admin|seller|get-products');
The idea is that in the first route it is verified if the user has access to tenant_id and if he has access, return only the products of that tenant_id (here Polices can be useful and solve the problem).
The second route, on the other hand, must return all products of all tenant_id that the user has access to. For this, I use static :: addGlobalScope() to set the tenants that the user has access to in this way:
$builder->whereIn('tenant_id', $tenants);
The question is how to check in GlobalScope if tenant_id was filled in the model. So, if it is present, I only check the permission and if it is not present I include the tenant_id that the user has access to.
I hope I have been able to adequately exemplify the problem.
Any help is most welcome.
Thank you!
I am new to Laravel and I want to make data in my database available via RESTFUL API. I need to control permissions of data objects with field level specificity. I was curious what is the idiomatic way to do this in Laravel?
For example, I will have a database table called PrintMachine that has the fields Id,MachineName,ActivityStatus,ManufacturingYear. I want to assign the following permissions:
Web Administrators get Read and Edit access to all records and all fields in PrintMachine
Factory Managers get Read and Edit access to the PrintMachine.MachineName and PrintMachine.ActivityStatus fields for all records and get no access to any other fields in PrintMachine.
Floor Operators get Read access to the PrintMachine.MachineName field for all records and get no access to any other fields in PrintMachine.
People told me to consider Spatie Module and also read Gates and Policies, but it's not clear how either achieves field level permissions on their own.
The other option I was considering was to custom create my own solution by:
for GET requests, create three ViewModels called PrintMachineAdmin,PrintMachineManager,PrintMachineOperator, each class with properties accessible to the corresponding roles.
for POST/PUT requests, I'll have to write my own conditional statements to validate data based on the users roles
Is there a more idiomatic way to develop the a feature for field level permissions for restful apis?
So many options. An implementation of role and permission structure can achieve this and you can most certainly do this via the Spatie Module.
Eg adapted from spatie documentation:
$role = Role::create(['name' => 'Manager']); //db has roles table
//or if already created
//$role = Role::where('name', 'Manager')->first();
$permission = Permission::create(['name' => 'edit PrintMachine.MachineName']); //db permissions table
$role->givePermissionTo($permission); //now manager role has been assigned permission to edit machine name.
//assigning role to user
$user = User::create(['name'=> 'Manager User']); //or get existing
$user->assigneRole($role); //now this user has edit access to machine name
//to see if user has access
if( $user->hasPermissionTo('edit PrintMachine.MachineName') )
//do efit
//OR if you want to check using role
if( $user->hasRole('Manager')
//do manager stuff
//and in view you can use #can blade directive
#can( 'edit PrintMachine.MachineName' )
//authenticated user can edit machine name //show edit button/form
#endcan
//similarly #role directive will do the check using role
For super admins in AuthServiceProvider's boot method.
Gate::before(function ($user, $ability) {
return $user->hasRole('Super Admin') ? true : null;
});
Gate's before method precedes all other gate operations so all other permissions can be overridden here.
I am new to laravel and do not have much experience with using ORM. I am building a system in which I need build functionality to allow user to switch clients with another user. I am not sure what is the best method to achieve this.
Currently client belongs to user, do I need another association for client and user model using different foreign key ?
public function clients()
{
return $this->hasMany('App\Client');
}
public function user()
{
return $this->belongsTo('App\User');
}
Even though a client can only have one user switch request I would like to track all the requests so for example if user A makes request to switch client Test with user B and then make another request to switch the same client with user C I would like to soft delete the first record and create new record for new request. Once the other user accepts the request we change the primary key for client Test in the clients table. Will this be a One To Many / Many To Many relationship ?
What table naming conventions do I need to follow ? Any help will be much appreciated.
If I understand you correctly, you would like to temporarily switch clients for one user to another. What you should do is have another table say switched-clients that holds records for the switches with columns user1 and user2. When you want to retrieve clients, your controller checks this table first and if the record exists where('user1', 'user A') (according to your example), then you retrieve the clients for user2.
Im working on a project to learn Vue.js with Laravel.
I created a simple tasks application, where its possible to create, modify, mark as done, and delete tasks.
I wish to make it user individual, so i ran artisan make:auth to create the auth template.
Added column : user_id to tasks table.
In the Index method of TaskController instead of -
return Task::all();
I tried to do -
return Task::where('user_id', Auth::id() );
but its not working as I wish...
If instead of Auth::id() I put 1 for example, it does return the tasks for user id 1.
Can anyone help me out?
Check in your code that Auth::id() is actually returning the user's ID - it's likely that your user isn't authenticated and is therefore returning null, so the query doesn't work as you expect.
Also, if you set up your associations correctly (that is, a user hasMany tasks) then you could simplify the code by using the association instead.
return Auth::user()->tasks;
// Achieves same result as...
return Task::where('user_id', Auth::id())->get();