##Default Middleware
For checking against a single permission (see Best Practices) using can, you can use the built-in Laravel middleware provided by \Illuminate\Auth\Middleware\Authorize::class like this:
Route::group(['middleware' => ['can:publish articles']], function () {
});
##Package Middleware
This package comes with RoleMiddleware, PermissionMiddleware and RoleOrPermissionMiddleware middleware. You can add them inside your app/Http/Kernel.php file.
protected $routeMiddleware = [
'role' => \Spatie\Permission\Middlewares\RoleMiddleware::class,
'permission' => \Spatie\Permission\Middlewares\PermissionMiddleware::class,
'role_or_permission' => \Spatie\Permission\Middlewares\RoleOrPermissionMiddleware::class,
];
Then you can protect your routes using middleware rules:
Route::group(['middleware' => ['role:super-admin']], function () {
});
Route::group(['middleware' => ['permission:publish articles']], function () {
});
Route::group(['middleware' => ['role:super-admin','permission:publish articles']], function () {
});
Route::group(['middleware' => ['role_or_permission:super-admin|edit articles']], function () {
});
Route::group(['middleware' => ['role_or_permission:publish articles']], function () {
});
Alternatively, you can separate multiple roles or permission with a | (pipe) character:
Route::group(['middleware' => ['role:super-admin|writer']], function () {
});
Route::group(['middleware' => ['permission:publish articles|edit articles']], function () {
});
Route::group(['middleware' => ['role_or_permission:super-admin|edit articles']], function () {
});
You can protect your controllers similarly, by setting desired middleware in the constructor:
public function __construct()
{
$this->middleware(['role:super-admin','permission:publish articles|edit articles']);
}
public function __construct()
{
$this->middleware(['role_or_permission:super-admin|edit articles']);
}