Bài 10: Authorization — Gates & Policies

Laravel: Từ Cơ bản đến Nâng cao

Phần 3: Authentication & Authorization

xdev.asia

1. Gates

// AppServiceProvider
use Illuminate\Support\Facades\Gate;

Gate::define('manage-products', function (User $user) {
    return $user->role === 'admin' || $user->role === 'staff';
});

Gate::define('update-product', function (User $user, Product $product) {
    return $user->id === $product->user_id || $user->role === 'admin';
});

// Sử dụng
if (Gate::allows('manage-products')) { ... }
Gate::authorize('update-product', $product);

2. Policies

php artisan make:policy ProductPolicy --model=Product

namespace App\Policies;

class ProductPolicy
{
    public function viewAny(User $user): bool
    {
        return true;
    }

    public function create(User $user): bool
    {
        return $user->hasPermissionTo('create products');
    }

    public function update(User $user, Product $product): bool
    {
        return $user->id === $product->user_id
            || $user->hasRole('admin');
    }

    public function delete(User $user, Product $product): bool
    {
        return $user->hasRole('admin');
    }
}

// Controller
public function update(Request $request, Product $product)
{
    $this->authorize('update', $product);
    // ...
}

3. Spatie Laravel Permission

composer require spatie/laravel-permission
php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"

use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable
{
    use HasRoles;
}

// Tạo roles & permissions
$admin = Role::create(['name' => 'admin']);
$editor = Role::create(['name' => 'editor']);

Permission::create(['name' => 'create products']);
Permission::create(['name' => 'edit products']);
$admin->givePermissionTo(Permission::all());
$editor->givePermissionTo(['create products', 'edit products']);

// Gán
$user->assignRole('editor');
$user->hasRole('admin'); // false
$user->hasPermissionTo('edit products'); // true

4. Blade Authorization

@can('update', $product)
    <a href="{{ route('products.edit', $product) }}">Sửa</a>
@endcan

@role('admin')
    <a href="/admin">Admin Panel</a>
@endrole

@hasanyrole('admin|editor')
    <x-editor-toolbar />
@endhasanyrole

Bài tiếp theo: OAuth2, Passport & Socialite.