Laravel中添加管理员登录与CRUD权限控制实现方案咨询

Hey there! Great question—adding admin-level access control to your Laravel app (after using php artisan make:auth) is straightforward once you break it down. Here's how to implement it step by step:

1. Add a Role Field to the Users Table #

First, we need a way to distinguish admins from regular users. Let's add a boolean is_admin column to your users table:

• Generate a migration:

  php artisan make:migration add_is_admin_to_users_table --table=users
  

• Open the new migration file (in database/migrations/) and update the up() method:

  public function up()
  {
      Schema::table('users', function (Blueprint $table) {
          $table->boolean('is_admin')->default(false);
      });
  }
  

• Run the migration:

  php artisan migrate
  

2. Set Up Admin Users #

Now, mark existing users as admins (you can do this via Tinker or a future admin panel):

• Launch Laravel Tinker:

  php artisan tinker
  

• Update a user to be an admin (replace 1 with the user ID you want to promote):

  App\Models\User::find(1)->update(['is_admin' => true]);
  

• Exit Tinker with exit.

3. Create an Admin Middleware #

Middleware will check if a user is an admin before allowing access to CRUD routes:

• Generate the middleware:

  php artisan make:middleware IsAdmin
  

• Open app/Http/Middleware/IsAdmin.php and update the handle() method:

  public function handle(Request $request, Closure $next)
  {
      // Check if user is logged in and is an admin
      if (!auth()->check() || !auth()->user()->is_admin) {
          // Redirect regular users or guests to home (or show 403)
          abort(403, 'You are not authorized to access this page.');
      }
  
      return $next($request);
  }
  

4. Register the Middleware #

Add the new middleware to your app's kernel so it's available for routes:

• Open app/Http/Kernel.php and add this line to the $routeMiddleware array:

  'admin' => \App\Http\Middleware\IsAdmin::class,
  

5. Protect CRUD Routes with the Middleware #

Wrap your CRUD routes with the admin middleware to restrict access:

• In routes/web.php, update your resource routes (or route groups) like this:

  // Example: Protect all Post CRUD routes
  Route::resource('posts', PostController::class)->middleware('admin');
  
  // Or group multiple admin routes together
  Route::middleware(['auth', 'admin'])->group(function () {
      Route::resource('posts', PostController::class);
      Route::resource('categories', CategoryController::class);
      // Add other CRUD routes here
  });
  

  Note: The auth middleware ensures the user is logged in, and admin checks if they're an admin.

6. Update Views to Show/Hide Admin Content #

Make sure regular users don't see admin-only links in your UI:

• In your blade templates (e.g., resources/views/layouts/app.blade.php), use conditional logic:

  @if(auth()->check() && auth()->user()->is_admin)
      <li class="nav-item">
          <a class="nav-link" href="{{ route('posts.index') }}">Manage Posts</a>
      </li>
  @endif
  

Optional: Separate Admin Login (If Needed) #

Most apps don't need a separate admin login—since permissions are role-based, regular login works fine. But if you want a dedicated admin login page:

• Create a new AdminLoginController (copy logic from LoginController),
• Add a custom login route pointing to this controller,
• And adjust the middleware to only allow admins to use this route (though this is redundant if you already have the is_admin check).

That's it! Now admins can access all CRUD operations, while regular users will get a 403 error if they try to navigate to those routes, and won't see admin links in the UI.

内容的提问来源于stack exchange，提问作者Eugen Gîrlescu