Laravel中多用户团队账号的操作授权实现方案问询

Alright, let's tackle this team-based authorization setup since you already have your Team and User models in place with that one-to-many relationship and the global scope for eager loading the team. Here's a structured, practical approach to build out the authorization layer:

First, let's lock in the core rules that will drive the system:

• Super Admin vs. Regular Member Distinction: The first user created for a Team gets super_admin privileges (full control over the team and its members). All subsequent users are default members with limited access.
• Team Boundary Enforcement: No user should access or modify resources outside of their associated Team. Your existing global scope makes this easier since we always have the user's team available.

1. Add Role Field to User Model #

Start by extending your User model to track roles. First, run a migration:

Schema::table('users', function (Blueprint $table) {
    $table->enum('role', ['super_admin', 'member'])->default('member');
});

When creating the first user during Team setup, explicitly set their role to super_admin:

// Inside your Team creation logic
$team = Team::create($teamCreationData);
$team->users()->create([
    'name' => $request->name,
    'email' => $request->email,
    'password' => Hash::make($request->password),
    'role' => 'super_admin' // Mark first user as super admin
]);

2. Build Authorization Policies #

Policies are the cleanest way to encapsulate permission logic. Let's create two policies: one for Team actions, and one for managing team members.

TeamPolicy (Manage Team Settings) #

class TeamPolicy
{
    // Only super admins can update team details
    public function update(User $user, Team $team)
    {
        return $user->team->id === $team->id && $user->role === 'super_admin';
    }

    // Only super admins can delete the team
    public function delete(User $user, Team $team)
    {
        return $user->team->id === $team->id && $user->role === 'super_admin';
    }
}

UserPolicy (Manage Team Members) #

class UserPolicy
{
    // Only super admins can add new members to their team
    public function create(User $authUser, Team $team)
    {
        return $authUser->team->id === $team->id && $authUser->role === 'super_admin';
    }

    // Members can edit their own profile; super admins can edit anyone in the team
    public function update(User $authUser, User $targetUser)
    {
        if ($authUser->id === $targetUser->id) {
            return true;
        }
        return $authUser->team->id === $targetUser->team->id && $authUser->role === 'super_admin';
    }

    // Super admins can remove members (but not themselves)
    public function delete(User $authUser, User $targetUser)
    {
        return $authUser->team->id === $targetUser->team->id 
            && $authUser->role === 'super_admin' 
            && $authUser->id !== $targetUser->id;
    }
}

Register these policies in your AuthServiceProvider:

protected $policies = [
    Team::class => TeamPolicy::class,
    User::class => UserPolicy::class,
];

3. Add Team Access Middleware #

Create a middleware to block cross-team access at the route level:

class EnsureBelongsToTeam
{
    public function handle(Request $request, Closure $next)
    {
        $targetTeamId = $request->route('team'); // Match your route parameter name
        if ($request->user()->team->id !== $targetTeamId) {
            abort(403, 'You don\'t have permission to access this team.');
        }
        return $next($request);
    }
}

Register it in app/Http/Kernel.php:

protected $routeMiddleware = [
    // ... existing middleware
    'belongsToTeam' => \App\Http\Middleware\EnsureBelongsToTeam::class,
];

Apply it to your team-focused routes, paired with policy checks:

Route::prefix('teams/{team}')->middleware(['auth', 'belongsToTeam'])->group(function () {
    Route::get('/', [TeamController::class, 'show']);
    Route::put('/', [TeamController::class, 'update'])->can('update', 'team');
    Route::post('/users', [UserController::class, 'store'])->can('create', 'team');
    Route::put('/users/{user}', [UserController::class, 'update'])->can('update', 'user');
});

4. UI-Level Permission Checks #

In your Blade templates, use @can directives to show/hide elements based on user permissions:

<div class="team-actions">
    @can('update', $team)
        <button class="btn btn-primary">Edit Team Settings</button>
    @endcan

    @can('create', $team)
        <a href="{{ route('teams.users.create', $team) }}" class="btn btn-success">Add New Member</a>
    @endcan
</div>

• Audit Logs: Add logging for super admin actions (like adding/removing members) to track team changes over time.
• Role Expansion: If you need more granular roles later (like 'editor' or 'viewer'), just extend the role enum and update the policies accordingly.
• API Support: For APIs, use Laravel's Gate facade in controllers or add policy checks to form request classes for validation.

内容的提问来源于stack exchange，提问作者Kārlis Janisels