Laravel-permission: Roles/permissions to a single instance of a model

[grantholle]

I tried searching and thinking of a solution but I couldn't come up with one...

Let's say I have articles. I have a user that creates an article, giving that user an "editor" role _on that specific article_ and has full access. But what if I wanted that editor to add someone to have permission to edit certain aspects of that article, giving them a "contributor" role.

I can't think of the right way to word this problem. I want to assign roles to per instances of a model, not to that model in general (?).

Thanks for this amazing package and for possible feedback!

[drbyte]

I'm inclined to suggest that you create a pivot table, one-to-many, like article_contributors which pivots around article_id and user_id.

That wouldn't necessarily leverage this package at all, but you could create a gate/policy that combines the checks:

  return $user->can('edit all articles') 
         || $user->hasRole('articles moderator') 
         || $article->author === $user->id
         || $article->contributors->contains($user->id);

[grantholle]

Thanks @drbyte

It's sort of like a nested role/permission. So I would use general site roles/permissions, but also individual roles/permissions per article.

I think you're on the right track with using gates and policies in some sort of combination. Thanks again

[drbyte]

Right. This package provides role/permission support based on "membership to a permission/role (or combinations)", and some degree of connection of those to specific models.

But your userland model logic is outside this scope, and that's where model policies come in. As you say, nesting the two layers together.

[drbyte]

@zarya Here's an example of implementing a model policy which incorporates permissions managed by this package
https://github.com/drbyte/spatie-permissions-demo/pull/2/files

[zarya]

Tnx i figured most of those parts out my only issue is that i was looking for a option to have many authors with different permissions for a single instance of Post

[drbyte]

If this is something you'll need for additional single instances, then it might be necessary to expand the schema to add an instance-id (and make the primary-key include that instance-id), and of course the associated queries.

[ImadSalimi]

I doubt you still need an answer to this, but this might help someone who stumbles on this issue in the future.

A smart solution to accomplish what you want would be: if for example I want a user to have permission edit articles, but only on article with ID 45, then the permission name should be a concatenation of these two; i.e: edit articles 45.

I'm looking to implement this package myself in a personal project and thought of the same issue, but only now did I figure out the way and I'm sharing it with you :)

[tylerwiegand]

Struggling with this concept as well, @ImadSalimi have you found that your method doesn't yield slow queries for permission checks? I'm concerned that 4-5 of these in one page will drastically slow down load times...

[ImadSalimi]

@tylerwiegand I wouldn't say it slows the queries since the package caches the roles & permissions, but it's a bit excessive in terms of how many rows you would have in those tables.

[grantholle]

There's another popular roles/permissions package called Bouncer, which has this functionality of restricting permissions to a model and specific model instance.

[muhammadsalmankhalid]

@ImadSalimi .. I acknowleged your pattern of implementing nested permissions to specific record . @tylerwiegand I think cache will never let down the performance speed .I am actually going to implementing that strategy .Can you tell me bit more How it will slow down the proesss ? . Above concepts for the pivot tables and other are complex and will be difficuilt to manage that.?