授权与权限 #

认证 vs 授权
├── 认证(Authentication)
│   └── 你是谁？
└── 授权(Authorization)
    └── 你能做什么？

Laravel授权方式
├── Gates
│   └── 闭包定义权限
├── Policies
│   └── 类定义资源权限
└── 中间件
    └── 路由级别权限检查

// app/Providers/AuthServiceProvider.php

public function boot()
{
    $this->registerPolicies();

    // 简单Gate
    Gate::define('access-admin', function ($user) {
        return $user->is_admin;
    });

    // 带参数的Gate
    Gate::define('update-post', function ($user, $post) {
        return $user->id === $post->user_id;
    });

    // 使用类方法
    Gate::define('edit-settings', [SettingsPolicy::class, 'edit']);
}

// 通过Gate门面
if (Gate::allows('access-admin')) {
    // 允许
}

if (Gate::denies('access-admin')) {
    // 拒绝
}

// 带参数检查
if (Gate::allows('update-post', $post)) {
    // 允许
}

// 检查任意用户权限
if (Gate::forUser($user)->allows('update-post', $post)) {
    // 允许
}

// 授权失败抛出异常
Gate::authorize('update-post', $post);

// 等同于
if (Gate::denies('update-post', $post)) {
    abort(403);
}

@can('update-post', $post)
    <a href="{{ route('posts.edit', $post) }}">编辑</a>
@endcan

@cannot('update-post', $post)
    <p>无权编辑</p>
@endcannot

@canany(['update-post', 'delete-post'], $post)
    <p>可以编辑或删除</p>
@endcanany

php artisan make:policy PostPolicy

# 同时生成模型关联
php artisan make:policy PostPolicy --model=Post

// app/Policies/PostPolicy.php
namespace App\Policies;

use App\Models\Post;
use App\Models\User;

class PostPolicy
{
    public function viewAny(User $user)
    {
        return true;
    }

    public function view(User $user, Post $post)
    {
        return true;
    }

    public function create(User $user)
    {
        return true;
    }

    public function update(User $user, Post $post)
    {
        return $user->id === $post->user_id;
    }

    public function delete(User $user, Post $post)
    {
        return $user->id === $post->user_id;
    }

    public function restore(User $user, Post $post)
    {
        return $user->id === $post->user_id;
    }

    public function forceDelete(User $user, Post $post)
    {
        return $user->id === $post->user_id;
    }
}

// app/Providers/AuthServiceProvider.php

protected $policies = [
    Post::class => PostPolicy::class,
];

// 控制器中
public function update(Request $request, Post $post)
{
    $this->authorize('update', $post);
    
    // 或
    if ($request->user()->cannot('update', $post)) {
        abort(403);
    }
    
    // 更新文章
}

// 不需要传递模型的方法
public function create(Request $request)
{
    $this->authorize('create', Post::class);
    
    // 创建文章
}

class PostController extends Controller
{
    public function __construct()
    {
        $this->authorizeResource(Post::class, 'post');
    }
}

// 路由中使用
Route::put('/posts/{post}', [PostController::class, 'update'])
    ->middleware('can:update,post');

// 控制器构造函数
public function __construct()
{
    $this->middleware('can:update,post')->only('update');
}

// 用户表添加角色字段
Schema::table('users', function (Blueprint $table) {
    $table->string('role')->default('user');
});

// 或使用多对多关系
Schema::create('roles', function (Blueprint $table) {
    $table->id();
    $table->string('name');
    $table->timestamps();
});

Schema::create('permissions', function (Blueprint $table) {
    $table->id();
    $table->string('name');
    $table->timestamps();
});

Schema::create('role_user', function (Blueprint $table) {
    $table->foreignId('role_id')->constrained();
    $table->foreignId('user_id')->constrained();
});

Schema::create('permission_role', function (Blueprint $table) {
    $table->foreignId('permission_id')->constrained();
    $table->foreignId('role_id')->constrained();
});

class User extends Model
{
    public function roles()
    {
        return $this->belongsToMany(Role::class);
    }

    public function permissions()
    {
        return $this->belongsToMany(Permission::class);
    }

    public function hasRole($role)
    {
        if (is_string($role)) {
            return $this->roles->contains('name', $role);
        }
        
        return $role->intersect($this->roles)->isNotEmpty();
    }

    public function hasPermission($permission)
    {
        if (is_string($permission)) {
            return $this->permissions->contains('name', $permission);
        }
        
        return $permission->intersect($this->permissions)->isNotEmpty();
    }

    public function hasPermissionThroughRole($permission)
    {
        foreach ($permission->roles as $role) {
            if ($this->roles->contains($role)) {
                return true;
            }
        }
        
        return false;
    }
}

// AuthServiceProvider.php
public function boot()
{
    $this->registerPolicies();

    Gate::before(function ($user, $ability) {
        if ($user->hasRole('admin')) {
            return true;
        }
    });

    Gate::define('edit-posts', function ($user) {
        return $user->hasPermission('edit-posts');
    });
}

class PostPolicy
{
    public function update(User $user, Post $post)
    {
        return $user->id === $post->user_id
            ? Response::allow()
            : Response::deny('您无权编辑此文章');
    }
}

public function update(Request $request, Post $post)
{
    $response = Gate::inspect('update', $post);

    if ($response->allowed()) {
        // 允许
    } else {
        echo $response->message();
    }
}

// app/Providers/AuthServiceProvider.php

protected $policies = [
    // 手动注册
];

// 自动发现
public function boot()
{
    Gate::guessPolicyNamesUsing(function ($modelClass) {
        return 'App\\Policies\\' . class_basename($modelClass) . 'Policy';
    });
}

// PostPolicy.php
class PostPolicy
{
    public function viewAny(User $user)
    {
        return true;
    }

    public function view(User $user, Post $post)
    {
        return $post->published || $user->id === $post->user_id;
    }

    public function create(User $user)
    {
        return $user->hasVerifiedEmail();
    }

    public function update(User $user, Post $post)
    {
        return $user->id === $post->user_id || $user->hasRole('editor');
    }

    public function delete(User $user, Post $post)
    {
        return $user->id === $post->user_id || $user->hasRole('admin');
    }

    public function publish(User $user, Post $post)
    {
        return $user->hasRole('editor') || $user->hasRole('admin');
    }
}

class PostController extends Controller
{
    public function __construct()
    {
        $this->authorizeResource(Post::class, 'post');
    }

    public function index()
    {
        $posts = Post::all();
        return view('posts.index', compact('posts'));
    }

    public function create()
    {
        return view('posts.create');
    }

    public function store(Request $request)
    {
        $post = Post::create($request->validated());
        return redirect()->route('posts.show', $post);
    }

    public function edit(Post $post)
    {
        return view('posts.edit', compact('post'));
    }

    public function update(Request $request, Post $post)
    {
        $post->update($request->validated());
        return redirect()->route('posts.show', $post);
    }

    public function destroy(Post $post)
    {
        $post->delete();
        return redirect()->route('posts.index');
    }
}

@foreach($posts as $post)
    <div class="post">
        <h2>{{ $post->title }}</h2>
        
        @can('update', $post)
            <a href="{{ route('posts.edit', $post) }}">编辑</a>
        @endcan
        
        @can('delete', $post)
            <form action="{{ route('posts.destroy', $post) }}" method="POST">
                @csrf
                @method('DELETE')
                <button type="submit">删除</button>
            </form>
        @endcan
    </div>
@endforeach