Laravel 5.5无依赖包实现ACL：特定用户分配权限最优方案咨询

Hey there! Let's tackle this Laravel 5.5 ACL problem without relying on any third-party packages. First, let's break down why your initial pivot table approach has flaws, then walk through a robust, native solution that handles both individual user permissions and role-based access (with the flexibility to override roles for specific users).

Your original idea of a direct user_permission pivot table works for simple cases, but it falls short in a few key ways:

• No way to group permissions into roles, so you'll end up duplicating permission entries for every user who needs the same access
• No hierarchy or inheritance, making it hard to scale as your app grows
• You'll have to write custom validation logic everywhere instead of leveraging Laravel's built-in authorization tools

This approach combines role-based access with optional individual user permissions, using Laravel's native Gate system and model relationships.

1. Database Table Structure #

We'll need 5 tables total: core tables for roles and permissions, plus pivot tables to handle relationships between users/roles, roles/permissions, and users/permissions (for individual overrides).

Migration Files #

Create these migrations one by one:

Permissions Table

Schema::create('permissions', function (Blueprint $table) {
    $table->increments('id');
    $table->string('name')->unique(); // e.g., 'edit_post', 'delete_user'
    $table->string('display_name')->nullable(); // Human-readable name, e.g., "Edit Posts"
    $table->string('description')->nullable(); // Brief explanation of the permission
    $table->timestamps();
});

Roles Table

Schema::create('roles', function (Blueprint $table) {
    $table->increments('id');
    $table->string('name')->unique(); // e.g., 'admin', 'editor', 'viewer'
    $table->string('display_name')->nullable();
    $table->string('description')->nullable();
    $table->timestamps();
});

Pivot Tables

// User-Role relationship
Schema::create('role_user', function (Blueprint $table) {
    $table->integer('user_id')->unsigned();
    $table->integer('role_id')->unsigned();
    $table->primary(['user_id', 'role_id']);
    $table->foreign('user_id')->references('id')->on('users')->onDelete('cascade');
    $table->foreign('role_id')->references('id')->on('roles')->onDelete('cascade');
});

// Role-Permission relationship
Schema::create('permission_role', function (Blueprint $table) {
    $table->integer('permission_id')->unsigned();
    $table->integer('role_id')->unsigned();
    $table->primary(['permission_id', 'role_id']);
    $table->foreign('permission_id')->references('id')->on('permissions')->onDelete('cascade');
    $table->foreign('role_id')->references('id')->on('roles')->onDelete('cascade');
});

// User-Permission relationship (for individual overrides)
Schema::create('permission_user', function (Blueprint $table) {
    $table->integer('permission_id')->unsigned();
    $table->integer('user_id')->unsigned();
    $table->primary(['permission_id', 'user_id']);
    $table->foreign('permission_id')->references('id')->on('permissions')->onDelete('cascade');
    $table->foreign('user_id')->references('id')->on('users')->onDelete('cascade');
});

2. Model Relationships #

Update your models to define the many-to-many relationships:

User Model #

namespace App;

use Illuminate\Notifications\Notifiable;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable
{
    use Notifiable;

    // Link user to roles
    public function roles()
    {
        return $this->belongsToMany(Role::class);
    }

    // Link user to individual permissions
    public function permissions()
    {
        return $this->belongsToMany(Permission::class);
    }

    // Check if user has a specific permission (prioritize individual permissions over roles)
    public function hasPermission(string $permissionName): bool
    {
        // First check if user has the permission assigned directly
        if ($this->permissions()->where('name', $permissionName)->exists()) {
            return true;
        }

        // Then check if any of the user's roles have the permission
        foreach ($this->roles as $role) {
            if ($role->permissions()->where('name', $permissionName)->exists()) {
                return true;
            }
        }

        return false;
    }
}

Role Model #

namespace App;

use Illuminate\Database\Eloquent\Model;

class Role extends Model
{
    public function users()
    {
        return $this->belongsToMany(User::class);
    }

    public function permissions()
    {
        return $this->belongsToMany(Permission::class);
    }
}

Permission Model #

namespace App;

use Illuminate\Database\Eloquent\Model;

class Permission extends Model
{
    public function roles()
    {
        return $this->belongsToMany(Role::class);
    }

    public function users()
    {
        return $this->belongsToMany(User::class);
    }
}

3. Register Gates for Global Validation #

Use Laravel's Gate system to make permission checks available everywhere in your app. Update app/Providers/AuthServiceProvider.php:

namespace App\Providers;

use Illuminate\Support\Facades\Gate;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;

class AuthServiceProvider extends ServiceProvider
{
    protected $policies = [
        // Add policies here if you need model-specific authorization
    ];

    public function boot()
    {
        $this->registerPolicies();

        // Dynamically register all permissions as Gates
        foreach (\App\Permission::all() as $permission) {
            Gate::define($permission->name, function ($user) use ($permission) {
                return $user->hasPermission($permission->name);
            });
        }
    }
}

4. How to Use This System #

Assign Permissions to Users/Roles #

// Assign a role to a user
$user = \App\User::find(1);
$adminRole = \App\Role::where('name', 'admin')->first();
$user->roles()->attach($adminRole);

// Assign a direct permission to a user (overrides role permissions)
$editPostPerm = \App\Permission::where('name', 'edit_post')->first();
$user->permissions()->attach($editPostPerm);

// Remove a permission from a user
$user->permissions()->detach($editPostPerm);

Check Permissions #

In Controllers

// Basic check
if (Gate::allows('edit_post')) {
    // User can edit posts
}

// Use the authorize middleware
public function edit(Post $post)
{
    $this->authorize('edit_post');
    // Proceed with edit logic
}

In Blade Templates

@can('edit_post')
    <a href="{{ route('posts.edit', $post) }}">Edit Post</a>
@endcan

// Or use Gate directly
@if(Gate::allows('delete_user'))
    <button class="btn-danger">Delete User</button>
@endif

Why This Is Better Than Your Initial Approach #

• Scalability: Group permissions into roles to avoid duplicate entries for users with similar access
• Flexibility: Override role permissions with individual user permissions for edge cases
• Native Integration: Uses Laravel's built-in authorization tools, so no third-party dependencies to maintain or learn
• Maintainability: All permission logic is centralized, making it easy to update or debug

内容的提问来源于stack exchange，提问作者prit.patel