Middleware not working when using teams

[nikklass]

I have used laratrust to implemenet roles using the teams feature and now i wud like to group routes under a middleware. When i was not using teams i could do:

Route::group(['middleware' => 'role:superadministrator|administrator'], function() {
	... routes here....
});

and it wud work ok. But when i switched to using teams, it no longer works unless i add a team name at the end of the middleware filter. Like:

Route::group(['middleware' => 'role:superadministrator|administrator,team_name'], function() {
... routes here....
});

Is this how its supposed to work?

I wud like to leave the team_name out of my middleware filter since i have many dynamic teams and it wud be impossible to list them all in the middleware. I wud want to simply deny or allow access based on roles not roles in teams. Is that possible?

Rgds.
Nikk

[roelgonzalez]

+1

[nikklass]

I temporarily solved it by using @roelgonzalez94 hack by adding the following method to the user model:

public function isInSameTeam($rolePermission, $team)
    {
        if (config('laratrust.use_teams') || is_null($team)) {
            return true;
        }

        $teamForeignKey = $this->teamForeignKey();
        return $rolePermission->pivot->$teamForeignKey == $team;
    }

[santigarcor]

If you attach a role to a user within a group, and then check it without the specific group, it will return false, because it's not the same to have a permission within a group that outside a group.

If you don't use the team to check if a user can do something, there's no way to control if the permission you are checking for is attached to the user within that team or that same permission is attach to another team.

[nikklass]

Thats fine. What I want to achieve was when limiting access on routes through routes middleware, i dont want to specify team names in the filter, coz the teams are created by users dynamically. I simply wanted to allow users to access routes based on their access levels/ roles e.g. group admin is allowed access to group admin features/ pages. But when they open the route, I would then check the user role based on the team/ group they have access to using the controller. I think you should allow for such a flexibility for those who would want to use teams feature. The other features, like you have specified are quite ok with me.

[santigarcor]

So basically you are saying that if you check for the role without team, it just ignores the team on the check, but if you pass the team it checks the permission and if it's attached within that team?

[nikklass]

yes

[santigarcor]

But what about the attaching and detaching? This logic can't be applied to those.

[nikklass]

Attaching and detaching functions don't need to change. They work ok. I thought this would work well in checking for permissions on the routes middleware. Since users may want to restrict routes through a middleware, it will enable them restrict certain routes to certain roles, without the need to specify which group these roles have been assigned. Its only for checking. Coz at the moment, if i dont specify a team name in my middleware filters when using teams, it throws back a 403.

[santigarcor]

This logic may have some sense, but it's a breaking change, so maybe this change can be done for the next release.

[nikklass]

ok. Thanks for the good work u doing.

[santigarcor]

Reopening because the code isn't ready yet.