在Laravel 8中使用Jetstream和Spatie实现用户角色与权限管理

composer require spatie/laravel-permission

php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider" --tag="permission-migrations"
php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider" --tag="permission-config"

php artisan migrate

<?php

namespace App\Models;

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Fortify\TwoFactorAuthenticatable;
use Laravel\Jetstream\HasProfilePhoto;
use Laravel\Sanctum\HasApiTokens;
use Spatie\Permission\Traits\HasRoles; // 引入HasRoles Trait

class User extends Authenticatable
{
    use HasApiTokens,
        HasFactory,
        Notifiable,
        HasProfilePhoto,
        TwoFactorAuthenticatable,
        HasRoles; // 使用HasRoles Trait

    // ... 其他模型属性和方法
}

use Spatie\Permission\Models\Role;
use Spatie\Permission\Models\Permission;

// 创建权限
$permission1 = Permission::create(['name' => 'edit articles']);
$permission2 = Permission::create(['name' => 'delete articles']);
$permission3 = Permission::create(['name' => 'publish articles']);
$permission4 = Permission::create(['name' => 'manage users']);

// 创建角色
$roleAdmin = Role::create(['name' => 'admin']);
$roleEditor = Role::create(['name' => 'editor']);
$roleViewer = Role::create(['name' => 'viewer']);

// 为角色分配权限
$roleAdmin->givePermissionTo(['edit articles', 'delete articles', 'publish articles', 'manage users']);
$roleEditor->givePermissionTo(['edit articles', 'publish articles']);
$roleViewer->givePermissionTo([]); // 观众角色暂时没有特定权限

$user = App\Models\User::find(1); // 获取一个用户实例

// 为用户分配角色
$user->assignRole('admin'); // 分配 'admin' 角色
// $user->assignRole(['editor', 'viewer']); // 分配多个角色

// 移除用户的角色
// $user->removeRole('viewer');

// 检查用户是否拥有某个角色
if ($user->hasRole('admin')) {
    // ...
}

// 直接为用户赋予权限（权限覆盖）
// 即使用户没有通过角色获得 'delete articles' 权限，也可以直接赋予
$user->givePermissionTo('delete articles');

// 撤销用户直接拥有的权限
// $user->revokePermissionTo('delete articles');

// 检查用户是否拥有某个权限
if ($user->can('edit articles')) {
    // ...
}

use Illuminate\Support\Facades\Auth;

public function updateArticle(Request $request, Article $article)
{
    if (Auth::user()->can('edit articles')) {
        // 用户有权限编辑文章，执行更新操作
        $article->update($request->all());
        return redirect()->back()->with('success', '文章更新成功！');
    }

    abort(403, '你没有编辑文章的权限。');
}

@can('edit articles')
    <a href="{{ route('articles.edit', $article) }}" class="btn btn-primary">编辑文章</a>
@endcan

@role('admin')
    <a href="{{ route('users.index') }}" class="btn btn-danger">管理用户</a>
@endrole

{{-- 结合角色和权限 --}}
@hasrole('editor')
    @can('publish articles')
        <button type="submit">发布文章</button>
    @endcan
@endhasrole

protected $routeMiddleware = [
    // ... 其他中间件
    'role' => \Spatie\Permission\Middlewares\RoleMiddleware::class,
    'permission' => \Spatie\Permission\Middlewares\PermissionMiddleware::class,
    'role_or_permission' => \Spatie\Permission\Middlewares\RoleOrPermissionMiddleware::class,
];

Route::middleware(['auth', 'role:admin'])->group(function () {
    Route::resource('users', UserController::class);
});

Route::middleware(['auth', 'permission:edit articles'])->group(function () {
    Route::get('articles/{article}/edit', [ArticleController::class, 'edit']);
    Route::put('articles/{article}', [ArticleController::class, 'update']);
});

// 允许拥有 'admin' 角色 或 'manage users' 权限的用户访问
Route::get('/dashboard', function () {
    // ...
})->middleware(['auth', 'role_or_permission:admin|manage users']);