How to block same type of users accessing others data in Laravel?

Question

I have two two type of users for my project, admin and clients. I need to block clients from accessing other clients details by passing id through URL as explained below. In this clients there is two categories, premium clients and guest clients. Here also I need above feature. I am routing to different dashboards to admin and clients using filters. My filter.php file is given below.

Route::filter('auth', function()
{
    if (Auth::guest())
    {
        if (Request::ajax())
        {
            return Response::make('Unauthorized', 401);
        }
        else
        {
            return Redirect::route('home');
        }
    }
});

Route::filter('admin', function()
{
    if (Auth::user()->isAdmin != 0) return Redirect::route('getLogout');
});
Route::filter('client', function()
{
    if (Auth::user()->isAdmin != 1) return Redirect::route('getLogout');
});

Thsi is working properly.

But if a client tries to access other clients details via URL, he will get it. For example, in my project there one URL to access clients profile. This is done by passing client id via url like this "localhost/public/profile/{id}". Part of route.php file is given below.

Route::group(array('before' => 'auth'), function()
{
     Route::group(array('before' => 'auth|client'), function() 
     {
        Route::get('profile/{id}', array('uses' => 'ClientController@viewProfile', 'as' =>'viewProfile'));
     });
});

How to block clients from accessing other clients profile by passing their id, using filters or other method? I tried by specifying in controller, but it is not looking good.

Also in my clients, two type clients are there. Premium and guest clients. These types specified in model named Clients for table named clients. In clients table there is field named type. I need to block guest clients from accessing some URL that premium clients can access.

Can anyone help??

Answer 1

The basic idea would be to create a custom filter that gets the current user's ID, compares it to the user ID from the request and then takes the required action, which would probably be to redirect somewhere else. Wrap this around any routes you want this to affect.

The filter would look something like this:

Route::filter('profile_access', function($route, $request, $value)
{
    $requestedId = $route->getParameter('id');
    $userId = MyUserService::getCurrentUser()->getId();

    // compare and redirect...
});