C.A.R. 911 uses the Spatie Laravel Permission package to manage user roles and permissions. This provides a flexible and powerful system for controlling access to different parts of the application.
Spatie Permission Package
The application uses Spatie Laravel Permission version 5.5:
"spatie/laravel-permission": "^5.5"
User Model Configuration
The User model includes the HasRoles trait to enable role and permission functionality:
use Spatie\Permission\Traits\HasRoles;
class User extends Authenticatable
{
use HasApiTokens, HasFactory, Notifiable, HasRoles;
}
Role Management
Roles are managed through the RolController, which provides full CRUD operations.
Role Controller Permissions
The controller uses middleware to restrict access based on permissions:
function __construct(){
$this->middleware('permission:ver-rol|crear-rol|editar-rol|borrar-rol', ['only'=>['index']]);
$this->middleware('permission:crear-rol', ['only'=>['create', 'store']]);
$this->middleware('permission:editar-rol', ['only'=>['edit', 'update']]);
$this->middleware('permission:borrar-rol', ['only'=>['destroy']]);
}
Permission Types
The system uses four main permission types for role management:
View and list all roles in the system
Create new roles and assign permissions
Edit existing roles and update their permissions
Delete roles from the system
Working with Roles
Listing Roles
Retrieve all roles with pagination:
public function index()
{
$roles = Role::paginate(100);
return view('roles.index', compact('roles'));
}
Creating a Role
Load Create Form
The create method retrieves all available permissions:public function create()
{
$permission = Permission::get();
return view('roles.crear', compact('permission'));
}
Validate Input
The store method validates that both name and permissions are provided:$this->validate($request, [
'name' => 'required',
'permission' => 'required'
]);
Create and Sync Permissions
Create the role and sync permissions in one operation:$role = Role::create(['name' => $request->input('name')]);
$role->syncPermissions($request->input('permission'));
return redirect()->route('roles.index');
Editing a Role
To edit a role, you need to retrieve the role, all permissions, and the role’s current permissions:
public function edit($id)
{
$role = Role::find($id);
$permission = Permission::get();
$rolePermissions = DB::table("role_has_permissions")
->where("role_has_permissions.role_id", $id)
->pluck('role_has_permissions.permission_id','role_has_permissions.permission_id')
->all();
return view('roles.editar', compact('role','permission','rolePermissions'));
}
Updating a Role
Update the role name and sync new permissions:
public function update(Request $request, $id)
{
$this->validate($request, [
'name' => 'required',
'permission' => 'required',
]);
$role = Role::find($id);
$role->name = $request->input('name');
$role->save();
$role->syncPermissions($request->input('permission'));
return redirect()->route('roles.index');
}
The syncPermissions() method automatically removes old permissions and assigns new ones, ensuring the role has exactly the permissions specified.
Deleting a Role
Delete a role from the database:
public function destroy($id)
{
DB::table('roles')->where('id', $id)->delete();
return redirect()->route('roles.index');
}
Deleting a role will affect all users assigned to that role. Ensure you reassign users before deleting important roles.
Permission System
Permissions are managed using Spatie’s Permission model:
use Spatie\Permission\Models\Role;
use Spatie\Permission\Models\Permission;
Database Structure
The permission system uses the following tables:
roles - Stores role definitionspermissions - Stores permission definitionsrole_has_permissions - Links roles to permissionsmodel_has_roles - Links users to roles
Routes for Role Management
Role management routes are protected by authentication:
Route::group(['middleware' => ['auth']], function () {
Route::resource('roles', RolController::class);
});
GET /roles - List all rolesGET /roles/create - Show create formPOST /roles - Store new roleGET /roles/{id}/edit - Show edit formPUT /roles/{id} - Update roleDELETE /roles/{id} - Delete role
Assigning Roles to Users
Roles are assigned when creating or updating users through the UsuarioController:
// When creating a user
$user = User::create($input);
$user->assignRole($request->input('roles'));
// When updating a user
$user = User::find($id);
$user->update($input);
DB::table('model_has_roles')->where('model_id', $id)->delete();
$user->assignRole($request->input('roles'));
When updating user roles, the system first removes all existing role assignments before assigning new ones to ensure consistency.
Checking Permissions in Controllers
You can protect controller methods using permission middleware:
$this->middleware('permission:ver-rol|crear-rol', ['only'=>['index']]);
Role Display Utilities
The User model includes a helper method to get role colors:
public function getRoleColor($roleName) {
$role = \Spatie\Permission\Models\Role::where('name', $roleName)->first();
return $role ? $role->color : null;
}
Best Practices
Plan Your Permissions
Define clear, granular permissions for each feature (e.g., ver-rol, crear-rol, editar-rol, borrar-rol).
Use Middleware Protection
Always protect routes and controller methods with appropriate permission checks.
Sync Permissions Carefully
When updating roles, use syncPermissions() to ensure the role has exactly the permissions you intend.
Test Permission Changes
After modifying roles or permissions, test with different user accounts to verify access control works correctly.