Role based access control for Laravel 5

0.2 2016-01-16 10:59 UTC

This package is not auto-updated.

Last update: 2021-01-20 06:45:10 UTC


Super simple RBAC/ACL implementation for Laravel 5.


Require this package with composer (Packagist) using the following command

composer require phpzen/laravel-rbac

or modify your composer.json

"require": {
    "phpzen/laravel-rbac": "^0.2"

then run composer update.

After installation register the ServiceProvider to the providers array in config/app.php


Publish migration files

$ php artisan vendor:publish --provider="PHPZen\LaravelRbac\RbacServiceProvider" --force

Run migrations

$ php artisan migrate

Add RBAC middleware to your app/Http/Kernel.php

protected $routeMiddleware = [
    'rbac' => '\PHPZen\LaravelRbac\Middleware\Rbac::class'

Add Rbac trait to your User model

use PHPZen\LaravelRbac\Traits\Rbac;
class User extends Authenticatable
    use Rbac;



Create role

$adminRole = new Role;
$adminRole->name = 'Administrator';
$adminRole->slug = 'administrator';
$adminRole->description = 'System Administrator';

$editorRole = new Role;
$editorRole->name = 'Editor';
$editorRole->slug = 'editor';
$editorRole->description = 'Editor';

Assign role to user

$user = User::find(1);

you can also assign multiple roles at once

$user->roles()->attach([$adminRole->id, $editorRole->id]);

Revoke role from user


you can also revoke multiple roles at once

$user->roles()->detach([$adminRole->id, $editorRole->id]);

Sync roles


Any role already assigned to user will be revoked if you don't pass its id to sync method.


Create permission

$createUser = new Permission;
$createUser->name = 'Create user';
$createUser->slug = 'user.create';
$createUser->description = 'Permission to create user';

$updateUser = new Permission;
$updateUser->name = 'Update user';
$updateUser->slug = 'user.update';
$updateUser->description = 'Permission to update user';

Assign permission to role

$adminRole = Role::find(1);

you can also assign multiple permissions at once

$adminRole->permissions()->attach([$createUser->id, $updateUser->id]);

Revoke permission from role


you can also revoke multiple permissions at once

$adminRole->permissions()->detach([$createUser->id, $updateUser->id]);

Sync permissions


Any permission already assigned to role will be revoked if you don't pass its id to sync method.

Check user roles/permissions

Roles and permissions can be checked on User instance using hasRole and canDo methods.

$isAdmin = Auth::user()->hasRole('administrator'); // pass role slug as parameter
$isAdminOrEditor = Auth::user()->hasRole('administrator|editor'); // using OR operator
$canUpdateUser = Auth::user()->canDo('update.user'); // pass permission slug as parameter
$canUpdateOrCreateUser = Auth::user()->canDo('update.user|create.user'); // using OR operator

Protect routes

Laravel RBAC provides middleware to protect single route and route groups. Middleware expects 2 comma separated params:

  • is or can as first param - what to check (role/permission)
  • role/permission slug as second param
Route::get('/backend', [
    'uses' => 'BackendController@index',
    'middleware' => ['auth', 'rbac:is,administrator']
Route::get('/backend', [
    'uses' => 'BackendController@index',
    'middleware' => ['auth', 'rbac:is,administrator|editor']
Route::get('/dashboard', [
    'uses' => 'DashboardController@index',
    'middleware' => ['auth', 'rbac:can,view.dashboard']
Route::get('/dashboard', [
    'uses' => 'DashboardController@index',
    'middleware' => ['auth', 'rbac:can,view.dashboard|view.statistics']

Blade directive

Laravel RBAC provides two Blade directives to check if user has role/permission assigned.

Check for role

    // show admin content here
    // sorry

    // show editor content here
    // sorry

Check for permission

    // show delete button

    // show delete button


Laravel RBAC is open-sourced software licensed under the MIT license