Hierarchical roles for a user, with child roles having different permissions on case based, Laravel Spatie

Question

In the application I am trying to build, I have two portals one for Admins and one for Users. As in a normal case scenario, I might have different Roles for the Admin portal, i.e., Super Admin, Admin, etc. and for the User Portal, I just have a User Role for now.

Now a user can create and join many group chats, and in each chat, the user can either be the Group Admin, a Group assistant, a normal participant or a spectator. Moreover, a group chat admin can allow or prevent users with a specific role to perform a specific action. for example, a group chat admin can prevent users with a normal participant role from typing in the group chat. Also the admin can choose to prevent a specific user from performing a specific action.

So a user should have a user role in order to join or create group chats, and can obtain a different sub role per group chat and different roles horizontally across different group chats. Is this possible with spatie/laravel-permission package?

What has been tried yet:

So far, I added few tables and logic that makes the work, but I think there are better approaches.

1. I've added the possible group chat roles in the roles table, i.e., group_admin, group_assistant, group_participant, etc. along with the super_admin, admin, and user roles. I gave the group chat roles the default permissions that they usually have.

2. I created a group_chat_users table with a group_chat_id, user_id, and role_id. here the role_id should be limited to only the group chat roles. So that we assign each a user a role by group chat

3. I created an additional table along side to Spatie's Permissions tables, which is, revoked_model_permission_roles that has the columns: model_type, model_id, revoked_type, revoked_id, and permission_id. In here, we have the corresponding model_type and model_id, in my case the group_chat and the group_chat_id. I also have have the revoked_type and revoked_id, which represents the model has been revoked which could be in this case either the whole Role (hence role as the revoked_type and role_id as the revoked_id) or the specific user (user model as revoked_type and user_id as revoked_id). And finally the permission column which states the permission that has been revoked for this User or Role.

4. I created a group chat policy where I check if the user, with a group chat role, has the corresponding permission to perform the action, which I check from the default role_has_permissions table of spatie, and if the permission has been revoked, which I check from the other the table that I created which is revoked_model_permission_roles.

Answer 1

Through spatie package you can create permissions for each role. You need to create roles and give permissions to every user accordingly. You can achieve that manually as well by creating tables for every role but it will be a lot more work.