如何解决Laravel应用中的用户权限管理难题？zizaco/entrust助你轻松实现RBAC！

<code class="bash">composer require zizaco/entrust:5.2.x-dev</code>

<pre class="brush:php;toolbar:false;">// config/app.php

'providers' => [
    // ...
    Zizaco\Entrust\EntrustServiceProvider::class,
],

'aliases' => [
    // ...
    'Entrust'   => Zizaco\Entrust\EntrustFacade::class,
],

<pre class="brush:php;toolbar:false;">php artisan vendor:publish
php artisan entrust:migration
php artisan migrate

<pre class="brush:php;toolbar:false;">// app/Models/User.php (或你的User模型路径)

use Zizaco\Entrust\Traits\EntrustUserTrait;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable
{
    use EntrustUserTrait; // 添加这一行

    // ... 其他模型内容
}

<pre class="brush:php;toolbar:false;">// app/Models/Role.php
namespace App\Models; // 根据你的命名空间调整

use Zizaco\Entrust\EntrustRole;

class Role extends EntrustRole
{
    protected $fillable = ['name', 'display_name', 'description'];
}

// app/Models/Permission.php
namespace App\Models; // 根据你的命名空间调整

use Zizaco\Entrust\EntrustPermission;

class Permission extends EntrustPermission
{
    protected $fillable = ['name', 'display_name', 'description'];
}

<pre class="brush:php;toolbar:false;">use App\Models\Role;
use App\Models\Permission;
use App\Models\User;

// 创建角色
$adminRole = Role::create([
    'name' => 'admin',
    'display_name' => 'Administrator',
    'description' => 'User is allowed to manage everything'
]);

$editorRole = Role::create([
    'name' => 'editor',
    'display_name' => 'Editor',
    'description' => 'User is allowed to edit content'
]);

// 创建权限
$createPost = Permission::create([
    'name' => 'create-post',
    'display_name' => 'Create Posts',
    'description' => 'create new blog posts'
]);

$editPost = Permission::create([
    'name' => 'edit-post',
    'display_name' => 'Edit Posts',
    'description' => 'edit existing blog posts'
]);

$deletePost = Permission::create([
    'name' => 'delete-post',
    'display_name' => 'Delete Posts',
    'description' => 'delete existing blog posts'
]);

// 将权限分配给角色
$adminRole->attachPermission($createPost);
$adminRole->attachPermission($editPost);
$adminRole->attachPermission($deletePost);

$editorRole->attachPermission($createPost);
$editorRole->attachPermission($editPost);

// 将角色分配给用户
$user = User::find(1); // 假设用户ID为1
$user->attachRole($adminRole); // 用户拥有管理员角色

$anotherUser = User::find(2); // 假设用户ID为2
$anotherUser->attachRole($editorRole); // 另一个用户拥有编辑角色

<pre class="brush:php;toolbar:false;">$user = Auth::user(); // 获取当前登录用户

if ($user->hasRole('admin')) {
    echo "你是管理员！";
}

if ($user->can('create-post')) {
    echo "你可以创建文章！";
}

// 检查是否同时拥有多个角色或权限（第二个参数为true表示“所有都必须拥有”）
if ($user->hasRole(['admin', 'editor'], true)) {
    echo "你是管理员和编辑！";
}

// 更复杂的组合检查（ability方法）
if ($user->ability(['admin', 'owner'], ['create-post', 'edit-user'])) {
    echo "你拥有管理员或所有者角色，并且可以创建文章或编辑用户！";
}

<pre class="brush:php;toolbar:false;">@role('admin')
    <a href="https://www.php.cn/link/685677a17902e2dbc239ca05391544e1" rel="nofollow" target="_blank" >管理员设置</a>
@endrole

@permission('create-post')
    <button>发布新文章</button>
@endpermission

@ability('admin,editor', 'edit-post')
    <p>只有管理员或编辑且能编辑文章的用户才能看到此内容。</p>
@endability

<pre class="brush:php;toolbar:false;">// app/Http/Kernel.php
protected $routeMiddleware = [
    // ...
    'role' => \Zizaco\Entrust\Middleware\EntrustRole::class,
    'permission' => \Zizaco\Entrust\Middleware\EntrustPermission::class,
    'ability' => \Zizaco\Entrust\Middleware\EntrustAbility::class,
];

<pre class="brush:php;toolbar:false;">// routes/web.php

Route::group(['prefix' => 'admin', 'middleware' => ['role:admin']], function () {
    Route::get('/', function () {
        return "欢迎来到管理员面板！";
    });
    Route::get('/posts/create', ['middleware' => ['permission:create-post'], function () {
        return "创建文章页面";
    }]);
});

// 使用 | 符号表示 OR 关系
Route::get('/dashboard', ['middleware' => ['role:admin|editor'], function () {
    return "管理员或编辑的仪表盘";
}]);

// 使用多个中间件实例表示 AND 关系
Route::get('/super-secret', ['middleware' => ['role:admin', 'permission:delete-all'], function () {
    return "只有拥有admin角色且能delete-all权限的用户才能访问";
}]);