Checking the user's role in Laravel

Question

I am beginner in Laravel. I have project in Laravel 5.8.

I have this code:

Middleweare:

class CheckRole
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next, $role)
    {
        if (! $request->user()->hasRole([$role])) {
            if( $role == 'admin' || $role== 'receptionist' || $role == 'adminCompany' || $role == 'telemarketer')
            {
                return redirect('/cms');
            }
            else
            {
                return redirect()->route('index');
            }

        }

        return $next($request);
    }
}

Seeder:

public function run()
    {
        DB::table('roles')->insert([
            'name' => 'admin'
        ]);
        DB::table('roles')->insert([
            'name' => 'adminCompany'
        ]);

        DB::table('roles')->insert([
            'name' => 'telemarketer'
        ]);

        DB::table('roles')->insert([
            'name' => 'receptionist'
        ]);

        DB::table('roles')->insert([
            'name' => 'user'
        ]);

        DB::table('roles')->insert([
            'name' => 'userPremium'
        ]);

        DB::table('roles')->insert([
            'name' => 'userCompany'
        ]);

        DB::table('roles')->insert([
            'name' => 'userSponsor'
        ]);

        DB::table('roles')->insert([
            'name' => 'userGuest'
        ]);

    }

Schema:

Schema::create('roles', function (Blueprint $table) {
            $table->bigIncrements('id');
            $table->string('name');
            $table->engine = "InnoDB";
        });

and my web.php:

Route::group(['prefix' => 'admin'], function () {
    Route::get('/', 'BackendController@index')->name('adminHome')->middleware('CheckRole:user,CheckRole:userPremium,CheckRole:userCompany,CheckRole:userSponsor,CheckRole:userGuest');
});

User.php

public function hasRole(array $roles)
    {

        foreach ($roles as $role) {

            if (isset(self::$roles[$role])) {
                if (self::$roles[$role]) return true;

            } else {
                self::$roles[$role] = $this->roles()->where('name', $role)->exists();
                if (self::$roles[$role]) return true;
            }

        }
        return false;
    }

I would like the CheckRole middleware to check if the user has the following roles: user, userPremium, userCompany, userSponsor, userGuest for route adminHome. At the moment, Laravel only checks 1 role - not all.

How repair it?

Answer 1

You should separate your parameters of your middleware by , instead of duplicate requests to the same middleware

Same issue here See: How to pass multiple parameters to middleware with OR condition in Laravel 5.2

You might consider https://github.com/spatie/laravel-permission a permission package.

Route::group(['prefix' => 'admin'], function () {
    Route::get('/', 'BackendController@index')->name('adminHome')->middleware('CheckRole:user,userPremium,userCompany,userSponsor,UserGuest');
});

Like in the article i posted above you need to handle the middleware parameters,

As by example from the other answer, something like this

/**
 * Handle an incoming request.
 *
 * @param $request
 * @param Closure $next
 * @return \Illuminate\Http\RedirectResponse|\Illuminate\Routing\Redirector
 */
public function handle($request, Closure $next) {

    $roles = array_slice(func_get_args(), 2); // [default, admin, manager]

    foreach ($roles as $role) {

        try {

            Role::whereName($role)->firstOrFail(); // make sure we got a "real" role

            if (Auth::user()->hasRole($role)) {
                return $next($request);
            }

        } catch (ModelNotFoundException $exception) {

            dd('Could not find role ' . $role);

        }
    }

    Flash::warning('Access Denied', 'You are not authorized to view that content.'); // custom flash class

    return redirect('/');
}

You probaly can access your $role, in laravel 5.8 just as an array or you should check if it's an array or string, and then loop trough them

Looks a bit cleaner then using func_get_args()