如何使用中间件根据用户角色重定向？

Question

I am doing project in laravel. I want to redirect user according to his role.

My tables are,

user table having fields (id,name,password).

role table having fields (id,role).

assigned_role table having fields (id,role_id,user_id).

I have User model as,

User.php

public function roles()
{
    return $this->belongsToMany('App\Role', 'assigned_roles', 'user_id', 'role_id');
}

For that I have created one middleware named as 'RoleMiddleware'

RoleMiddleware:

public function handle($request, Closure $next)
{
    $roles = $request->user()->roles;
    foreach ($roles as $role) {
        if($role->name != 'super-admin')
            return redirect('/user');
    }

    return $next($request);
}

I have this middleware in kernel.php file,

Kernel.php looks like,

 protected $routeMiddleware = [
    'auth' => \App\Http\Middleware\Authenticate::class,
    'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
    'can' => \Illuminate\Foundation\Http\Middleware\Authorize::class,
    'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
    'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
    'role' =>   \App\Http\Middleware\RoleMiddleware::class,

];

but now I don't know how to use this middleware. When I add this middleware in Route.php file as,

Route::group(['middleware' => 'web'], function () {

    Route::auth();
    Route::group(['middleware' => 'role'], function () {
        Route::get('/home', 'HomeController@index');
        Route::get('/user', 'UserController@index');

    });
});

But when I did sign in process it redirects to the correct url. But now it can give access to the inside pages without checking whether user is logged in or not. Whereas when I do comment to the RoleMiddleware part it prevents to access inside pages unless and user do logging.

I don't know how to do this.

Answer 1

If I understood you correctly:

• You want to restrict users that doesn't have the super-admin role (weither they are authenticated or not) to prevent them from accessing a certain URL.
• You are also trying to redirect any authenticated users which does not have the super-admin role to the url /user .

Correct?

Here's how to do this:

In your routes.php file you need to provide routes for the super-admin user and authenticated users (without super-admin role)

Route::group(['middleware' => 'web'], function () {

    Route::auth();

    Route::group(['middleware' => ['auth', 'role']], function () {
        // All routes you put here can only be accessible to users with super-admin role

    });

    Route::group(['middleware' => 'auth'], function () {
        // All routes you put here can be accessible to all authenticated users

    });
});

And in your role middleware you need to prevent authenticated users without the superadmin role to access the given url, in this case by simply redirecting them to another url

public function handle($request, Closure $next)
{
    $roles = $request->user()->roles;
    foreach ($roles as $role) {
        if($role->name == 'super-admin')
            // If user is super-admin, accept the request
            return $next($request);
    }
    // If user does not have the super-admin role redirect them to another page that isn't restricted
    return redirect('/user');        
}