README

This is a simple package that provides role-based access control (RBAC) for Laravel4 applications.

It is very similar to Authority-L4 in that it provides a Laravel 4 shell around the "Authority" package. This package however focuses on managing permissions assigned to "roles" rather than "users".

After examining a whole host of authorization systems for Laravel, I finally settled on Authority

Easy to understand and manage
No other external dependencies
Runs on PHP 5.3+
Works exactly as advertised

(As far as authentication is concerned, I believe the stock laravel implementation works perfectly)

To install RoleBasedAuthority via composer:

"require": {
		"laravel/framework": "4.2.*",
		"mnshankar/role-based-authority": "dev-master"
	},

Run composer update to bring in the dependencies.

Add to Provider list (app.php):

'mnshankar\RoleBasedAuthority\RoleBasedAuthorityServiceProvider',

Add to Alias list (app.php):

'Authority'        => 'mnshankar\RoleBasedAuthority\Facades\Authority',

Run all migrations (Remember to setup your database config prior to doing this. Note that it contains a migration for the users table, and as such you might want to inspect the code prior to running):

php artisan migrate --package="mnshankar/role-based-authority"

Publish the configuration file:

php artisan config:publish mnshankar/role-based-authority

(this central config file is where you would put all your rules. In order to cache the "Authority" object, set 'cache' to true and specify cache_ttl)

Create/Modify your User, Role and Permission models to permit relationships (many-to-many between users and roles, one-to-many between roles and permissions): User.php

...
public function roles() {
		return $this->belongsToMany('Role');
	}
public function hasRole($key)
    {
        foreach ($this->roles as $role) {            
            if ($role->role_name === $key) {
                return true;
            }
        }        
        return false;
    }	
...

Role.php

class Role extends Eloquent
{
	public function permissions() {
		return $this->hasMany('Permission');
	}
}

Permission.php

class Permission extends Eloquent
{
	
}

The major changes from Authority are:

DB migrations (include relationships between users,roles and permissions)
The "type" field in table "permissions" is set to enum (allow/deny)
Support for role inheritance (using the "inherited_roleid" column in Roles)
Config file changes (to loop through all user roles, and create rule list)
Support for caching the Authority object (set 'cache' to true in config file)

Common usage pattern:

Once you have the tables setup (with users, roles and permissions), checking authorization within your application is fairly trivial. Here is some seed data to get you started:

--create a user (pwd must be hashed!)
INSERT INTO users VALUES ('1', 'LastName', 'FirstName', 'email@email.com', 'hashedpwd****', now(), now());

-- Establish roles. member inherits from guest and admin inherits from member
INSERT INTO roles VALUES ('1', 'guest', null, now(), now());
INSERT INTO roles VALUES ('2', 'member', '1', now(), now());
INSERT INTO roles VALUES ('3', 'admin', '2', now(), now());

-- Assign roles to users. Userid 1 has 'admin' role
INSERT INTO role_user(role_id, user_id) VALUES ('3', '1');

-- Setup Permissions table
-- ----------------------------
-- Role id 3 (admin) is allowed action "admin" on "all" resources
-- NOTE: 'all' - is a special resource that can be used as a wildcard
-- https://github.com/machuga/authority/blob/master/src/Authority/Rule.php#L101
-- Role id 2 (member) is allowed "create", "view" and "edit" actions on resource named 'album'
-- ----------------------------
INSERT INTO permissions VALUES ('1', '3', 'allow', 'admin', 'all', now(), now());
INSERT INTO permissions VALUES ('2', '2', 'allow', 'create', 'album', now(), now());
INSERT INTO permissions VALUES ('3', '2', 'allow', 'view', 'album', now(), now());
INSERT INTO permissions VALUES ('4', '2', 'allow', 'edit', 'album', now(), now());

The following snippets of code demonstrate methods of checking for appropriate privileges:

/***Check in controller - create() method of resource album***/
//checks if the logged in user has authority to create an album
//if person with admin or member role is logged in, they will be permitted. Not otherwise

Auth::loginUsingId(1);  //force login - testing only
if (Authority::cannot('create', 'album')) {
       App::abort('403', 'Sorry! Not authorized');
}

Adding a role-check can be accomplished using filters like so:

Route::filter('admin', function(){
    if (!Auth::user()->hasRole('admin'))
    {
        return App::abort('403', 'You are not authorized.');
    }
});

('admin' can then be used as a before filter)

For more instructions on usage and available options, please follow the writeup on authority-l4 (and authority)

https://github.com/machuga/authority-l4

https://github.com/machuga/authority

mnshankar / role-based-authority

Maintainers

Details

README

Create/Modify your User, Role and Permission models to permit relationships (many-to-many between users and roles, one-to-many between roles and permissions): User.php

Role.php

Permission.php