laravel 授权、用户验证

记录帖 

一、授权

只允许管理员删除用户,给管理员授权时,可以这样做,首先:

创建UserPolicy类:

php artisan make:policy UserPolicy 
然后在UserPolicy中添加destroy方法
app/policies/UserPolicy.php
<?php
namespace App\Policies;
use App\Model\User;
use Illuminate\Auth\Access\HandlesAuthorization;
class UserPolicy
{
use HandlesAuthorization;
 public function destroy(User $currentUser, User $user)
//$currentUser 为当前登录的用户,$user为需要验证的用户
{
return $currentUser->is_admin && $currentUser->id !== $user->id;
}
}

 然后在AuthServiceProvider里添加:

\App\Model\User::class  => \App\Policies\UserPolicy::class,

app/providers/AuthServiceProvider.php

<?php
namespace App\Providers;
use Illuminate\Support\Facades\Gate;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
class AuthServiceProvider extends ServiceProvider
{
protected $policies = [
'App\Model' => 'App\Policies\ModelPolicy',
\App\Model\User::class => \App\Policies\UserPolicy::class,
];
} 
最后,在控制器方法中调用即可:
public function destroy(User $user)
{
$this->authorize('destroy', $user);
$user->delete();
session()->flash('success', '成功删除用户!');
return back();
}
posted @ 2018-04-13 10:30  一轮明月随潮涌  阅读(504)  评论(0编辑  收藏  举报