基于多用户角色的Laravel路由级中间件配置方案咨询

Alright, let's break down how to fix this messy routing and permission setup in your Laravel app. With 1500 ungrouped routes and 10 user roles with overlapping permissions, you need a scalable, maintainable solution—here's what I'd recommend:

Stop scattering permission logic across routes. Create a dedicated config file to define which roles can access which routes. This makes updates way easier than hunting through 1500 lines of code.

Create config/role_permissions.php with your mappings:

return [
    // Map route URIs (or route names, more on that later) to allowed roles
    'url-1' => ['user_type_1', 'user_type_4'],
    'url-2' => ['user_type_7', 'user_type_5', 'user_type_4'],
    'url-3' => ['user_type_5', 'user_type_1', 'user_type_3', 'user_type_6'],
    // Add all your remaining route-permission pairs here
];

Create a single middleware that checks if the authenticated user's role is allowed to access the current route. This replaces the need to add permission checks to every individual route.

Run this command to generate the middleware:

php artisan make:middleware CheckRolePermission

Then update the middleware file (app/Http/Middleware/CheckRolePermission.php):

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class CheckRolePermission
{
    public function handle(Request $request, Closure $next)
    {
        $user = Auth::user();
        
        // Redirect unauthenticated users
        if (!$user) {
            return redirect()->route('login');
        }

        // Bypass all checks for super admins (if you have one)
        if ($user->role === 'super_admin') {
            return $next($request);
        }

        // Get the current route's URI (use route name instead for better stability)
        $currentUri = $request->path();
        $permissions = config('role_permissions');

        // If the route isn't in our config, block access (or adjust as needed)
        if (!isset($permissions[$currentUri])) {
            abort(403, 'You don\'t have permission to access this resource.');
        }

        // Check if the user's role is in the allowed list for this route
        if (!in_array($user->role, $permissions[$currentUri])) {
            abort(403, 'You don\'t have permission to access this resource.');
        }

        return $next($request);
    }
}

Don't forget to register the middleware in app/Http/Kernel.php under the $routeMiddleware array:

protected $routeMiddleware = [
    // ... existing middleware
    'role.permission' => \App\Http\Middleware\CheckRolePermission::class,
];

Instead of attaching the middleware to each route, wrap all your routes in a single group (or split into logical subgroups) to apply the permission check universally.

If you want to apply the middleware to all 1500 routes:

// In routes/web.php
Route::middleware(['auth', 'role.permission'])->group(function () {
    // Paste all your 1500 routes here
    Route::get('url-1', [YourController::class, 'method1']);
    Route::get('url-2', [YourController::class, 'method2']);
    Route::get('url-3', [YourController::class, 'method3']);
    // ... rest of your routes
});

For better organization, split your routes into smaller files (e.g., routes/user_routes.php, routes/admin_routes.php) and load them into the group:

// In routes/web.php
Route::middleware(['auth', 'role.permission'])->group(function () {
    require __DIR__.'/user_routes.php';
    require __DIR__.'/admin_routes.php';
    // ... other route files
});

URIs can change over time, so using route names makes your permission mapping more robust. Update your routes to have names:

Route::get('url-1', [YourController::class, 'method1'])->name('resource.view');

Then adjust your config/role_permissions.php to use route names:

return [
    'resource.view' => ['user_type_1', 'user_type_4'],
    // ... other route name mappings
];

And update the middleware to get the route name instead of the URI:

$currentRouteName = $request->route()->getName();

• Cache Config: Run php artisan config:cache in production to cache your role-permission mapping for better performance.
• Handle Public Routes: If some routes don't need permission checks, move them outside the middleware group.
• Test Thoroughly: Verify each role can access the correct routes and gets blocked from unauthorized ones—consider writing feature tests for this.

This approach centralizes your permission logic, cleans up your route file, and makes future updates (like adding new roles or routes) much simpler.

内容的提问来源于stack exchange，提问作者Lokendra Parihar