Laravel - Parameterized route full acces only for admin, but specific access to user logged

Question

I'm buiding a user management system. The current routes on web.php are here:

Route::middleware(['admin'])
    ->prefix('users')
    ->name('users.')
    ->group(function() {
        Route::get('management/list', '\App\Http\Controllers\UserController@list');
        Route::resource('management', '\App\Http\Controllers\UserController');
    });

I have two levels of user: Administrator (middleware is admin) and Collaborator (middleware is auth).

My problem is with the route of edit and update from the users resource: users/management/{management}/edit

How can I do something like that to the users from auth middleware, to allow the route just if the parameter be the own user id for the Collaborator users?

Route::middleware(['auth'])
    ->prefix('users')
    ->name('users.')
    ->group(function() {
        Route::get('management/{auth()->id}/edit', '\App\Http\Controllers\UserController@edit');
    });

laravel.com/docs/10.x/routing#implicit-binding | laravel.com/docs/10.x/authorization#creating-policies — Jaquarh
– Jaquarh, Commented Jul 22, 2023 at 10:15

Toby Allen · Accepted Answer · 2023-10-21 07:30:44Z

0

I'm not sure you can do this however you can just look up the user again in your controller

Route::middleware(['auth'])
    ->prefix('users')
    ->name('users.')
    ->group(function() {
        Route::get('management/currentuser/edit', '\App\Http\Controllers\UserController@edit');
    });

This is also better practice as you are looking up logged in user not any user.

answered Oct 21, 2023 at 7:30

Toby Allen

11.3k12 gold badges80 silver badges132 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Laravel - Parameterized route full acces only for admin, but specific access to user logged

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related