Laravel 5.4 #21 : Roles and permissions (Part 3)

We continue with the roles and permissions section in Laravel. This part is going to be a bit dense, since we are going to do a lot of things. We will create a mini administration of users and we will be able to change their role and also we will be able to activate and deactivate users. All this, we can do it if our user has the administrator role.

First, we are going to start creating the controller. As usual, we will use the command that Laravel provide us.

1	php artisan make:controller Admin\UsersController

And add this code:

<?php

namespace App\Http\Controllers\Admin;

use Illuminate\Http\Request;

use App\Http\Controllers\Controller;

use Illuminate\Support\Facades\Auth;

use App\User;

use Spatie\Permission\Models\Role;

class UsersController extends Controller

{

public function index() {

$users = User::all();

$roles = Role::pluck('name', 'name');

return view('admin.users.index', ['users' => $users, 'roles' => $roles]);

}

public function activeDeactive(Request $request) {

if (Auth::id() != $request->user_id) {

$user = User::findOrFail($request->user_id);

$user->active = !$user->active;

$user->save();

return redirect()->route("admin.users.index")->with('success', $user->name." status has been changed!");

} else {

return redirect()->back()->withErrors(['You can\'t change your status!']);

}

public function changeRole(Request $request) {

if (Auth::id() != $request->user_id) {

$user = User::findOrFail($request->user_id);

$user->syncRoles($request->role);

return redirect()->route("admin.users.index")->with('success', $user->name." role has been changed!");

} else {

return redirect()->back()->withErrors(['You can\'t change your role!']);

}

It has 3 methods:

index: it sends the list of users to the view. And also the roles to show in the popup to change the role.
activeDeactive: it activates and deactivates the indicated user.
changeRole: it changes the role of the indicated user.

Create the view for the list of users and the popup for the change of role (index method):

@extends('layouts.app')

@section('content')

@include('includes.errors')

@if(session()->has('success'))

</div>

@endif

<thead>

<tr>

<th>Email</th>

<th>Options</th>

</tr>

</thead>

<tbody>

@forelse ($users as $user)

<tr class="{{ ($user->active == 0) ? 'danger' : '' }}">

<td>{{ $user->email }}</td>

<td>

@foreach ($user->roles()->pluck('name') as $role)

@endforeach

</td>

<td>

@if (Auth::id() != $user->id)

<button type="button" class="btn-modal-change-role btn btn-info btn-sm" data-userid="{{ $user->id }}" data-userrole="{{ $role }}">Change role</button>

{{ Form::open(['route' => ['admin.users.active_deactive'], 'method' => 'POST']) }}

{{ Form::submit(($user->active == 0) ? 'Reactive' : 'Deactivate', ['name' => 'submit', 'class' => 'btn btn-warning btn-sm']) }}

@endif

</td>

</tr>

@empty

<tr>

<td colspan="5">No results</td>

</tr>

@endforelse

</tbody>

</table>

</div>

<h3>Change role</h3>

</div>

{{ Form::open(['route' => ['admin.users.change_role'], 'method' => 'POST']) }}

<p>{{ Form::select('role', $roles, null, ['class' => 'form-control']) }}</p>

{{ Form::submit('Change', ['name' => 'submit', 'class' => 'btn btn-success btn-block btn-change-role']) }}

</div>

@endsection

Now, we are going to add the routes, but first we are going to create a middleware to check if the user has the administrator role:

1	php artisan make:middleware RoleMiddleware

And add this code, we can see it on the package documentation:

<?php

namespace App\Http\Middleware;

use Closure;

use Illuminate\Support\Facades\Auth;

class RoleMiddleware

{

/**

* Handle an incoming request.

* @param \Illuminate\Http\Request $request

* @param \Closure $next

* @return mixed

public function handle($request, Closure $next, $role = null, $permission = null )

{

if (Auth::guest()) {

return Redirect::guest('login');

}

if (!$request->user()->hasRole($role)) {

abort(403);

}

if ($permission != null && !$request->user()->can($permission)) {

abort(403);

}

return $next($request);

}

protected $routeMiddleware = [

...

'role' => \App\Http\Middleware\RoleMiddleware::class,

];

Once we get this done, we can add the routes with the middleware:

Route::group(['middleware' => ['auth', 'role:administrator'], 'prefix' => 'admin', 'as' => 'admin.'], function () {

Route::get('/users', 'Admin\UsersController@index')->name('users.index');

Route::post('/users/active_deactive', 'Admin\UsersController@activeDeactive')->name('users.active_deactive');

Route::post('/users/change_role', 'Admin\UsersController@changeRole')->name('users.change_role');

});

Now, we are going to add in the header the administration link:

@role('administrator')

Administration <span class="caret"></span>

</a>

<li>

Users

</a>

</li>

</ul>

</li>

@endrole

It is showed just if the user has the administrator role, this is done with the @role tag.

Open app.js and add this code to show the popup to change roles:

$(document).ready(function(){

$(".btn-modal-change-role").click(function(e) {

var currentUserRole = $(this).data("userrole");

var currentUserId = $(this).data("userid");

// add the user id of the selected user to the input

$("input[name='user_id']").val(currentUserId);

// select current role for the user selected

$("select[name='role']").val(currentUserRole);

$("#roleModal").modal("show");

});

And execute this command, in order that the js of the public folder is updated:

//if we are in development environment

npm run dev

//if we are in production environment

npm run prod

The result would be this: