Made withLaravelClip

Spatie Laravel Permission Package Tutorial | Introduction #1

S

Sarthaksavvy

Creator on the Laravel channel

Watch on YouTube ↗

181K viewsSep 25, 201814:23 runtime

Learn the fundamentals of the extremely popular Spatie Laravel Permission package in this introductory tutorial. This video guides you through the initial setup, including installation via Composer, publishing migrations, and configuring the package. You'll explore how to create…

Chapters

#laravel#clip#frameworks

Introduction to Spatie's Laravel Permission Package

This powerful package provides a flexible way to manage user roles and permissions in a Laravel application. It allows for a fine-grained access control system by associating permissions with roles, and then roles with users.

Installation and Setup

The initial setup involves a few simple Artisan commands and a small code change.

Install Package: Pull the package into your project using Composer.
```
composer require spatie/laravel-permission
```

Publish Assets: Publish the configuration file and database migrations.

php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"

Run Migrations: Create the necessary tables (roles, permissions, model_has_roles, etc.) in your database.
```
php artisan migrate
```

Update User Model: Add the HasRoles trait to your User model to enable the package's functionality.

use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable
{
    use Notifiable, HasRoles;
    // ...
}

Configuration Deep Dive

The published config/permission.php file offers significant customization:

Models: You can specify your own Role and Permission models if you need custom logic.
Table Names: Easily change the default database table names used by the package.
Caching: The package caches roles and permissions for performance. You can configure the cache expiration time (in minutes) and the cache store.

Important
By default, the package will throw an exception if a permission does not exist. You can control whether the permission name is displayed in the exception message via the display_permission_in_exception setting.

Core Operations: Creating & Assigning

Roles and permissions are managed through their respective Eloquent models.

Create a Role:

use Spatie\Permission\Models\Role;
$role = Role::create(['name' => 'writer']);

Create a Permission:

use Spatie\Permission\Models\Permission;
$permission = Permission::create(['name' => 'write post']);

Assign a Permission to a Role:

$role->givePermissionTo($permission);
// You can also pass the permission name as a string
$role->givePermissionTo('edit post');

Revoke a Permission from a Role:

$role->revokePermissionTo($permission);

Tip
The package also provides methods like syncPermissions() to assign multiple permissions at once, and removeRole() to detach a role from a permission, which simplifies management.

Introduction to Spatie's Permission Package

So, welcome to the Laravel Permission package tutorial. This package is supremely famous. Why? Because it has more than 1 million downloads. This package is created by Spatie. That means the person behind Spatie is Freek, and you know Freek, he is just like a package king because he has more than 200 packages just for Laravel. So Freek is very good on that.

And because this is a super famous package, so why not get into this? You have probably used this package, but if you have not used it, follow me for inside of this package. And if you have used, maybe you can find something new. So let's get started.

Project Setup and Package Installation

So here we can see we need to firstly grab this package by using the Composer, and obviously for that, we need a Laravel project. And for that, I already have Laravel 5.7 fresh installation. So if I go to the VS Code, you can see this is the Laravel app, and I'm just going to get this Spatie Laravel Permission package by Composer.

So while it's downloading, let's create a new terminal, integrated terminal of VS Code, and I'm going to say git init so that it will initialize the git inside this project. And let's now go to GitHub to create a new repository for this. So I'm going to create a new repository. That repository will be inside the Bitfumes, and I will say spatie-laravel-permission-tutorial. Super easy. So I will fill up the description later. So create the repository. And now I just need to commit and add the remote repository.

Committing Initial Project to GitHub

So go here. Git, and let's just see. It's completed. No, no problem. So git add ., commit with a message of initial. Simple thing. And now I'm going to add a remote repository and then git push origin master. Super easy steps. And you can see it is there. And if I refresh, yes, all these things are here.

Okay, so let's now see and, yeah, you can see this is completed. And because of this, now we have the Spatie Laravel Permission package here.

Publishing Migrations and Database Setup

Okay, so let's first see how we can start with this. After installing, we just need to publish the migrations. And let's now publish the migrations. And if I go to database/migrations, you can see we just have two tables migration. If I run it, I have another. But if you go inside that, you will have a one schema for permissions table, then for roles table, then model_has_permissions table, then model_has_roles table, and role_has_permission, and the final one, permission table. So all these things are here.

Let's now connect our project with a database called 'test' and everything are just pretty basic things. And you can see the test database is empty. So I'm going to migrate. So php artisan migrate. Simple. And yeah, it is done. So if I go refresh, all the tables are here. Let's now go to Firefox for the next thing.

Exploring the Configuration File

Yeah, we have done that. And now we need to publish the configurations. So let's see the configurations. So this configuration is inside our config folder. So if I go inside the config folder, you can see the new file is permission.php. This is the one which is just published. So now let's look inside this file.

So first thing, it's having the models. So all the models related to this package are permission and the exact model is here. So this means you can change if you want. So suppose you don't want to use the model of the package, you want your models, you can just define your model class here. Similarly for role. And then if you want to change the name of the tables you are going to use or your package is going to use, you can simply change the role and permission and all the table names.

Then comes the column name. Column name is for morphing. That if you are familiar with Eloquent's morph many, then it is very useful. And if you don't know, just check out the relationship on my Laravel 5.4 series. It's the same for 5.7, so no worries. Then comes the caching time. So because this package caches the permission and roles, I will show you how it's going to cache, but just for now, it's just going to cache it. And it's going to cache all the permission and role for 24 hours. If you want to change the expiration time of the caches, then you can define that here. And obviously, this has to be in minutes. So 24 hours times 60 minutes every hour. So this is this much amount of minutes. Then comes the display_permission_in_exception.

Suppose you are having any kind of exception related to the permission. So do you want to display that permission name on the exception? If yes, then change it to yours. But obviously, if your app is used for some other person, you don't want to display or disclose your permissions related to your admin sections. So that's all about this permission.php file, or simply call it config file.

Let's now move on to the next thing. Let's scroll down, and we are going to see some kind of things for Lumen.

Integrating with the User Model

Then, yeah, how we can use this with any existing model we have. So we have the user model and we just need to have this HasRoles trait. So let's go to VS Code once more and go to the User model. And here, just like we have Notifiable trait, we are going to use HasRoles. And yep, we need to import it also. So we have done that. Let's cool.

And if you are using other than any model which is not authenticatable model, then you need to define this guard_name of web or whatever you are having. So now we just need to see how we can create the role and permission. It's very easy. Let's just try to do one thing. I'm going to say php artisan make:auth so that I have a login/ID system in it. And in that way, if I go to... let's start the server too. So php artisan serve. And if I now go to localhost:8000, user. So let's say register quickly, and we are registered. And now let's do one thing. Here we have user is there.

Creating Roles and Permissions

And now what I am going to say, I'm going to create a new role. So to create a new role, which is very easy, let's just go to the HTTP controller, Home controller, and here we are going to create a role. So Role, the Role model, actually, then create. Role name is, let's say, 'writer'. A simple one. So we have done that. And obviously, this is giving error because I need to make this inside this square brackets.

So let's refresh. Nothing is displayed here. But if I go here, refresh the page, yes, we have one role of writer. Similarly, we can create a permission. So I can just say instead of Role, I will say Permission and Permission::create. And permission name is 'write post'. So it will be 'write post'.

And once more, let's go, refresh the page. Nothing is there. But now inside the permissions table, we have 'write post'. That's very easy and exactly given here, these things are here. Okay.

Assigning Permissions to a Role

Now we need to connect that role and the permission because a role is 'writer', so writer can write the post. So we need to connect these two so that if a user is assigned the role of writer, obviously he can write the post. So let's go here and again comment this. So let's grab the role. So I will say role is equal to Role::find(1) because we only have one role, so that's why I'm getting from one.

Then I will say role and give permission. So givePermissionTo and which permission? We need to get the permissions also. So it will be like permission is equal to Permission::findById(1). And we know it's still one. And giving the permission here. So now if I go once more to here, refresh the page, go to the Sequel Pro, we have the permission, we have the role, but at this time on the role_has_permissions, you can see permission and role are connected. So this is the way we can connect role, permission, and both of these two. This is nice.

So yeah, we can do the reverse also. We can have the permission and we can assign a role to it. So we have now permission. So let's now create another permission. So I am going to create a permission, 'edit post'. And I'm going to say a writer can edit a post also. So permission is equal to this. Let's comment this permission. So I'm getting the role, which is the writer. I have created the new permission, which is this one. Then I say this role, which is the writer, givePermissionTo('edit post'). Simple enough. So let's go and... so let's refresh. And yeah, if I refresh, two and one. So we have created another permission, which is 'edit post'. And now that role, that writer role, has also the permission of two. In that way, you can just interchange between role permission, permission role. You can assign roles to a permission, or you can give permissions to a particular role. So this is very nice. And you can see if you want to add more than one permissions to a role, you need to use the sync keyword. Similarly, for the permission, more than one role if you are assigning, then use the syncRoles and more than one roles.

Revoking Permissions and Roles

Similarly, let's now try to revoke the permissions. So we have these permissions. So permission has the... permission has the role. So we can say revoke the role. So let's say we are having the role and now I'm going to say permission removeRole and the role name. Simple enough. And yeah, we have this, refreshed page. And okay, we have 'edit post' permission already exist for the 'web'. So yeah, it's because, you can see this is giving exception because we already have the same permission and we are trying to create that, and that's why it's giving the error that, okay, 'edit post' permission is already there. So refresh once more. And undefined variable, because we don't have the permission. So let's grab the permission. So I think we have, yeah, here we have. So let's try to get the second one and once more try, and no error. This means now the permission and the role relationship for that permission ID 2 is gone.

So similarly, if you want to remove the permission for a role, we have just removed the role for permission. Let's remove. So we have role and revokePermissionTo and the permission like this. So let's grab the permission of one and let's check out the exact thing. Oh, permissionTo. So that has to be permissionTo, so like this. Okay. So let's once more go, refresh the page and everything is gone. No relationship between permission and the role.

Conclusion and Next Steps

So these things are very good. And in the next episode, we are going to see how we can use these permissions and roles on our model, that means a User model because we have given the trait of HasRoles. So if you have liked this episode, please go and subscribe to this channel for more Laravel related updates. And don't forget to like Bitfumes on Facebook, Twitter, and Instagram. We will meet in the next episode. Till then, goodbye.