PHPackages                             dmox/h-rbac - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. dmox/h-rbac

ActiveLibrary[Authentication & Authorization](/categories/authentication)

dmox/h-rbac
===========

Based on native Laravel's abilities. Hierarchical RBAC with callbacks.

v0.3.1.1(9y ago)014MITPHP

Since Mar 14Pushed 9y ago1 watchersCompare

[ Source](https://github.com/dmOx/h-rbac)[ Packagist](https://packagist.org/packages/dmox/h-rbac)[ Docs](https://github.com/dlnsk/h-rbac)[ RSS](/packages/dmox-h-rbac/feed)WikiDiscussions master Synced 2mo ago

READMEChangelog (1)Dependencies (2)Versions (7)Used By (0)

h-rbac
======

[](#h-rbac)

Based on native Laravel's 5 abilities. Hierarchical RBAC with callbacks.

[![Latest Version on Packagist](https://camo.githubusercontent.com/2e47ec33fdce45e370d4c12153b64617e233042edd6ebbee35f19627b334cc95/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f646c6e736b2f682d726261632e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/dlnsk/h-rbac)[![Software License](https://camo.githubusercontent.com/55c0218c8f8009f06ad4ddae837ddd05301481fcf0dff8e0ed9dadda8780713e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d627269676874677265656e2e7376673f7374796c653d666c61742d737175617265)](LICENSE.md)[![Build Status](https://camo.githubusercontent.com/02eb62f8be3ea14d3dae5d8c1aa965d397c4a90eb45f38639e5a8f920f9d343e/68747470733a2f2f696d672e736869656c64732e696f2f7472617669732f646c6e736b2f682d726261632f6d61737465722e7376673f7374796c653d666c61742d737175617265)](https://travis-ci.org/dlnsk/h-rbac)[![Coverage Status](https://camo.githubusercontent.com/f319b785ae25a669c83461a624c683cc9f5e33aa3023acfff69a10ddfa173f5c/68747470733a2f2f696d672e736869656c64732e696f2f7363727574696e697a65722f636f7665726167652f672f646c6e736b2f682d726261632e7376673f7374796c653d666c61742d737175617265)](https://scrutinizer-ci.com/g/dlnsk/h-rbac/code-structure)[![Quality Score](https://camo.githubusercontent.com/278430945f333bc4cd71d0d06674cc5394f16c444aedf04a4e96e69f0830266b/68747470733a2f2f696d672e736869656c64732e696f2f7363727574696e697a65722f672f646c6e736b2f682d726261632e7376673f7374796c653d666c61742d737175617265)](https://scrutinizer-ci.com/g/dlnsk/h-rbac)[![Total Downloads](https://camo.githubusercontent.com/64f0fa7ff0f60f794fd01aa6299d03647dc9a74af97de15d44c3f7f3caedd548/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f646c6e736b2f682d726261632e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/dlnsk/h-rbac)

In the process of creating my own projects I have formed an opinion about the minimum required ability of RBAC. It should allow:

- roles and permissions
- callbacks for permissions (for passing parameters in permission checking)
- permission's inheritance
- the way RBAC is served

Install
-------

[](#install)

> Keep in mind it's only for Laravel 5.1 and later.

Via Composer

```
$ composer require dlnsk/h-rbac
```

Add the service provider to `config/app.php`

```
Dlnsk\HierarchicalRBAC\HRBACServiceProvider::class,

```

Publish some cool stuff:

- config file (config/h-rbac.php)
- migration (add field `role` to `users` table)
- role/permission/callbacks configuration class (app/Classes/Authorization/AuthorizationClass.php)

with

```
php artisan vendor:publish --provider="Dlnsk\HierarchicalRBAC\HRBACServiceProvider"

```

Add roles, permissions which you need and callbacks where it needs and have fun!

Overview
--------

[](#overview)

This module is wrapper for [authorization logic](https://laravel.com/docs/5.2/authorization#checking-abilities) and control access to resources of Laravel 5.1 and later. Except you shouldn't define abilities, they will define automatically.

**Let's describe the minimum required ability of RBAC** (in my opinion).

### Roles and permissions

[](#roles-and-permissions)

It's clear.

### Callbacks for permissions

[](#callbacks-for-permissions)

Very common situation is to allow user to change only his own posts. With this package it's simple:

```
public function editOwnPost($user, $post) {
	return $user->id === $post->user_id;
}
```

and use as

```
if (\Gate::can('editOwnPost', $post)) {
}
```

You can pass any number of parameters in callback as array.

### Permission's inheritance

[](#permissions-inheritance)

As you see callbacks is very useful. But what about site manager who may edit any posts? Create separate permission? But which of it we should check?

Answer is use chained (inherited) permissions. Example:

`editPost` -> `editPostInCategory` -> `editOwnPost`

Each of this permission put in appropriate role but **we always check the first** (except in very rare cases):

```
if (\Gate::can('editPost', $post)) {
}
```

These permissions will be checked one by one until one of it will pass. In other case ability will be rejected for this user. So, we have many permissions with different buisnes logic but checking in code only one.

### The way RBAC is served

[](#the-way-rbac-is-served)

Very popular is to use database for store roles and permissions. It flexible but hard to support. Managing of roles and permissions required backend (but stil available to change directly in DB). When we start to use inheritance for permissions it becomes too difficult for direct changing.

In other case most projects aren't large. It need only few roles and permissions, so backend becomes economically inexpedient. Thus, I believe that file driven RBAC is enough for many projects. It's visual and simple for support.

Storage of roles and permissions is on another level of logic, so DB support may be added later.

Usage
-----

[](#usage)

As I said `h-rbac` is wrapper for [authorization logic](https://laravel.com/docs/5.2/authorization#checking-abilities) of Laravel 5.1 and later. So, you can use any features of it.

```
if (\Gate::allows('editPost', $post)) { // do something }
...
if (\Gate::denies('editPost', $post)) { abort(403); }
...
if (\Gate::forUser($user)->allows('editPost', $post)) { // do something }
```

From User model:

```
if ($request->user()->can('editPost', $post)) { // do something }
...
if ($request->user()->cannot('editPost', $post)) { abort(403); }
```

In controller:

```
$this->authorize('editPost', $post);
```

Within Blade

```
@can('editPost', $post)

@else

@endcan

```

Also in `h-rbac` we add directive `@role` which you can combine with `@else`

```
@role('user|manager')

@endrole

```

Configuration
-------------

[](#configuration)

When you publish configuration with `artisan` you'll have configuration class `app/Classes/Authorization/AuthorizationClass.php` where you should define permissions, roles and callbacks. You are free to move this file anywhere you want. Don't forget update `config/h-rbac.php` in this case.

Structure of configuration class:

```