I am in the development of a human resources system, for which I am using laravel in version 5.2. but I am in a dilemma when using middleware , so far I have 3 types of roles, the Administrator , Adminstrative and finally the Teacher that these are my user roles.
Kernel.php
protected $routeMiddleware = [
'auth' => \App\Http\Middleware\Authenticate::class,
'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
'can' => \Illuminate\Foundation\Http\Middleware\Authorize::class,
'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
'super' => \App\Http\Middleware\Super::class,
'docentes' => \App\Http\Middleware\docentes::class,
'administrativo' => \App\Http\Middleware\Administrativo::class,
];
Here I show my created middlewares
Authenticate.php
<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Support\Facades\Auth;
class Authenticate
{
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @param string|null $guard
* @return mixed
*/
public function handle($request, Closure $next, $guard = null)
{
if (Auth::guard($guard)->guest()) {
if ($request->ajax() || $request->wantsJson()) {
return response('Unauthorized.', 401);
}
//verificamos que tipo de usuario es si es docente mande al login de docente
if ($guard == 'docente'){
return redirect()->guest('docente/login');
}
return redirect()->guest('login');
}
return $next($request);
}
}
Note Here I manage two types of login
Administrative.php
<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Support\Facades\Auth;
class Administrativo
{
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @return mixed
*/
public function handle($request, Closure $next)
{
if (Auth::User()->tipo == 2) {
return $next($request);
}else{
return abort(403);
}
}
}
I do not put the other middlewares because they have the same structure, it only changes in the tipo
part.
My problem lies in creating the route groups and assigning them url, when the url is repeated in another routegroup but with different middleware, I get the error 403.
routes.php
Route::group(['middleware' => ['auth','super']], function () {
Route::get('modules/personal/','PersonalController@inicio');
}
Route::group(['middleware' => ['auth','administrativo']], function (){
Route::get('modules/personal/','PersonalController@inicio');
});
When I do this and I enter as adminstrativo the route works for me, but when I enter as a super user, it sends me the denied access.
So how would the correct way to add permissions on the system be using middleware?
I'm a little new in laravel thank you for your attention.