Access Control Lists (ACL) are a fundamental part of web application security, allowing you to control access to various resources based on user roles. In Laravel, implementing Role-Based Access Control (RBAC) with ACL is a powerful way to manage user permissions. In this post, we'll explore how to implement ACL in Laravel with a role-based approach, providing a full example with sample output.
Step 1: Set Up the Database
First, create a database table to store roles and permissions. For this example, we'll create two tables: roles and permissions.
CREATE TABLE roles (
id INT AUTO_INCREMENT PRIMARY KEY,
name VARCHAR(50) NOT NULL,
description VARCHAR(255) NOT NULL
);
CREATE TABLE permissions (
id INT AUTO_INCREMENT PRIMARY KEY,
name VARCHAR(50) NOT NULL,
description VARCHAR(255) NOT NULL
);
Step 2: Create Models and Relationships
Next, create Eloquent models for the Role and Permission tables, along with their relationships.
php artisan make:model Role
php artisan make:model Permission
In the models, define the many-to-many relationship between roles and permissions:
// Role.php
namespace App\Models;
use Illuminate\Database\Eloquent\Model;
class Role extends Model
{
protected $fillable = ['name', 'description'];
public function permissions()
{
return $this->belongsToMany(Permission::class);
}
}
// Permission.php
namespace App\Models;
use Illuminate\Database\Eloquent\Model;
class Permission extends Model
{
protected $fillable = ['name', 'description'];
public function roles()
{
return $this->belongsToMany(Role::class);
}
}
Step 3: Create Middleware
Now, create a middleware that checks whether the authenticated user has the required role to access specific routes.
php artisan make:middleware RoleMiddleware
In the RoleMiddleware.php file, implement the logic to check the user's role:
namespace App\Http\Middleware;
use Closure;
use Illuminate\Support\Facades\Auth;
class RoleMiddleware
{
public function handle($request, Closure $next, ...$roles)
{
if (!Auth::check()) {
return redirect()->route('login');
}
$user = Auth::user();
foreach ($roles as $role) {
if ($user->hasRole($role)) {
return $next($request);
}
}
return redirect()->route('unauthorized');
}
}
Step 4: Register the Middleware
Register the RoleMiddleware in the app/Http/Kernel.php file by adding it to the $routeMiddleware array.
protected $routeMiddleware = [
// Other middleware
'role' => \App\Http\Middleware\RoleMiddleware::class,
];
Step 5: Define Routes and Controller
In this example, let's create two routes: one that requires the admin role and another that requires the editor role. We'll use a controller to handle the requests.
// routes/web.php
use App\Http\Controllers\HomeController;
Route::get('/', [HomeController::class, 'index']);
Route::get('/admin', [HomeController::class, 'admin'])->middleware('role:admin');
Route::get('/editor', [HomeController::class, 'editor'])->middleware('role:editor');
Route::get('/unauthorized', [HomeController::class, 'unauthorized'])->name('unauthorized');
Step 6: Implement the Controller Logic
Create a controller to handle the routes defined in Step 5 and check the user's role.
php artisan make:controller HomeController
In the HomeController.php file:
namespace App\Http\Controllers;
use Illuminate\Http\Request;
class HomeController extends Controller
{
public function index()
{
return view('welcome');
}
public function admin()
{
return view('admin');
}
public function editor()
{
return view('editor');
}
public function unauthorized()
{
return view('unauthorized');
}
}
Step 7: Implement Role Check in the User Model
In the User model, define a method to check if the user has a specific role.
// User.php
namespace App\Models;
use Illuminate\Database\Eloquent\Model;
class User extends Model
{
// Your existing User model code
public function hasRole($role)
{
return $this->roles()->where('name', $role)->exists();
}
}
Step 8: Sample Views
Create views for the admin, editor, and unauthorized routes.
<!-- resources/views/admin.blade.php -->
@extends('layouts.app')
@section('content')
<h1>Welcome, Admin!</h1>
<p>This is the Admin Dashboard.</p>
@endsection
<!-- resources/views/editor.blade.php -->
@extends('layouts.app')
@section('content')
<h1>Welcome, Editor!</h1>
<p>This is the Editor Dashboard.</p>
@endsection
<!-- resources/views/unauthorized.blade.php -->
@extends('layouts.app')
@section('content')
<h1>Unauthorized Access</h1>
<p>You do not have permission to access this page.</p>
@endsection
Step 9: Test the Implementation
Now, run your Laravel application and access the routes /, /admin, and /editor. You should be redirected to the /login route, as we have not implemented authentication in this example.