Validate Authorization in Laravel 5.2 - laravel

Question

My roles are dynamic and their User's permission are also dynamic. I have two approaches to validate if the user is authorized to access the particular page.
Approach 1
class BaseController extends Controller
{
public function __construct() {
if(!\Auth::user()->IsPredefined) {
$result = $this->ValidateAuthorization();
if(!$result) {
\Auth::logout();
return redirect()->route("login");
}
}
}
private function ValidateAuthorization() {
$ActionName = \Route::getCurrentRoute()->getPath();
switch ($ActionName) {
case "ChangePassword":
$ModuleID = ModuleEnum::AccountManagemenet;
$ActionID = AccountActionEnum::ChangePassword;
return CheckUsePermissions($ModuleID, $ActionID);
}
}
private function CheckUsePermissions($ModuleID, $ActionID) {
$User = MySession::UserPermissions();
foreach($User->UserRolePermissions as $UserRolePermission) {
$CurrentActionID = $UserRolePermission->RolePermission->Permission->ActionID;
$CurrentModuleID = $UserRolePermission->RolePermission->Permission->ModuleID;
if($CurrentActionID == $ActionID && $CurrentModuleID == $ModuleID &&
$UserRolePermission->IsActive == true) {
return true;
}
}
return false;
}
}
Approach 2
Use Authorize method in Request class
public function authorize()
{
return true;
}
Confusion
If Approach 2 is good, should I create Request class for each Get, Put, Delete and POST?
Is there any better approach to validate authorization?

Answer 1

For Dynamic Roles I do something like this:
Let suppose I have following permissions:
Manage Users
Manage CMS
Manage Hotels
Manage Packages
Manage Roles
Now the Super Admin (who obviously has all the above permissions) can create a role, say, Hotel Manager and assign permission for only Manage Hotels.
Now for a route like:
Route::get('/admin/hotels', 'HotelsController#index')->name('admin.hotels.index');
I will put it in a Route Group with a middleware in it:
Route::group(['prefix' => '/admin/hotels', 'middleware' => ['permission:manage_hotels']], function () {
Route::get('/', 'HotelsController#index')->name('admin.hotels.index');
Route::post('/', 'HotelsController#create')->name('admin.hotels.create');
});
Then I will create a Permission middleware:
class Permission
{
public function handle($request, Closure $next, $permission)
{
//if not super admin (super admin role_id is 1)
if(auth()->user()->role_id != 1) {
//explode extra param passed to this middleware (here manage_hotels)
$permission_array = explode('_', $permission);
foreach ($permission_array as $key => $value) {
$permission_array[$key] = ucfirst($value);
}
$permission_name = implode(' ', $permission_array);
$permitted = auth()->user()->role->permissions()->where('name', $permission_name)->first();
if(! $permitted) {
return redirect()->route('admin.dashboard')->withErrors(['error' => ['message' => 'You are not allowed to perform this action.']]);
}
}
return $next($request);
}
}
Of course you'll need to wrap these routes into Admin Middleware which will ensure that user is logged in and has an admin role.

Answer 2

You should use middleware and use in routes
Route::group(['middleware' => ['auth', 'admin']], function () { });
Or you can use in every controller constructor
public function __construct()
{
$this->middleware('auth');
$this->middleware('admin');
}
Admin middleware like
class AdminAuthenticate
{
/**
* Handle an incoming request.
*
* #param \Illuminate\Http\Request $request
* #param \Closure $next
* #return mixed
*/
public function handle($request, Closure $next)
{
if (Auth::check()) {
if (Auth::user()->IsPredefined) {
$result = $this->ValidateAuthorization();
if(!$result) {
return redirect('/logout');
}
}
}
return $next($request);
}
}