在Laravel中基于用户角色限制数据访问

Question

I've the following scenario: I've employee role, which can add and edit only thier own data. Also there is manager role which can view the data of all employees. The data is stored in database. Where should I put the validation in this case.

Answer 1

You can use gates to check if a user has rights to do certain actions. Based on these you can fetch the data that is allowed for this user.

You can create a gate like so:

Gate::define('access-all-records', function ($user) {
    return $user->isManager; // Or any other way to find this out
});

And fetch data like this:

if (Gate::allows('access-all-records')) 
{
    // Fetch all records
}
else
{
    // Fetch data for this user
}