Teams permissions

NOTE: Those changes must be made before performing the migration. If you have already run the migration and want to upgrade your solution, you can run the artisan console command php artisan permission:setup-teams, to create a new migration file named xxxx_xx_xx_xx_add_teams_fields.php and then run php artisan migrate to upgrade your database tables.

When enabled, teams permissions offers you a flexible control for a variety of scenarios. The idea behind teams permissions is inspired by the default permission implementation of Laratrust.

Teams permissions can be enabled in the permission config file:

// config/permission.php
'teams' => true,

Also, if you want to use a custom foreign key for teams you must change in the permission config file:

// config/permission.php
'team_foreign_key' => 'custom_team_id',

##Working with Teams Permissions

After implements on login a solution for select a team on authentication (for example set team_id of the current selected team on session: session(['team_id' => $team->team_id]); ), we can set global team_id from anywhere, but works better if you create a Middleware, example:

namespace App\Http\Middleware;

class TeamsPermission{
    
    public function handle($request, \Closure $next){
        if(!empty(auth()->user())){
            // session value set on login
            setPermissionsTeamId(session('team_id'));
        }
        // other custom ways to get team_id
        /*if(!empty(auth('api')->user())){
            // `getTeamIdFromToken()` example of custom method for getting the set team_id 
            setPermissionsTeamId(auth('api')->user()->getTeamIdFromToken());
        }*/
        
        return $next($request);
    }
}

NOTE: You must add your custom Middleware to $middlewarePriority on app/Http/Kernel.php.

##Roles Creating

When creating a role you can pass the team_id as an optional parameter

// with null team_id it creates a global role, global roles can be assigned to any team and they are unique
Role::create(['name' => 'writer', 'team_id' => null]);

// creates a role with team_id = 1, team roles can have the same name on different teams
Role::create(['name' => 'reader', 'team_id' => 1]);

// creating a role without team_id makes the role take the default global team_id
Role::create(['name' => 'reviewer']);

##Roles/Permissions Assignment & Removal

The role/permission assignment and removal are the same, but they take the global team_id set on login for sync.

##Defining a Super-Admin on Teams

Global roles can be assigned to different teams, team_id as the primary key of the relationships is always required. If you want a "Super Admin" global role for a user, when you creates a new team you must assign it to your user. Example:

namespace App\Models;

class YourTeamModel extends \Illuminate\Database\Eloquent\Model
{
    // ...
    public static function boot()
    {
        parent::boot();

        // here assign this team to a global user with global default role
        self::created(function ($model) {
           // get session team_id for restore it later
           $session_team_id = getPermissionsTeamId();
           // set actual new team_id to package instance
           setPermissionsTeamId($model);
           // get the admin user and assign roles/permissions on new team model
           User::find('your_user_id')->assignRole('Super Admin');
           // restore session team_id to package instance
           setPermissionsTeamId($session_team_id);
        });
    }
    // ...
}