Best way to create a dynamic navigation based on permissions ?

[Twyar]

Hi,

I currently use Laravel, Vite and Vue3.
What i'd like to do is create a navigation/module sidebar based on permissions.

What have is the following database tables.

Modules (modules)

id	name	icon_class	route	created_at	updated_at
1	Dashboard	fa-regular fa-house	admin.dashboard.index	2023-09-28 10:46:31	2023-09-28 10:46:31
2	Analytics	fa-regular fa-chart-simple	admin.analytics.index	2023-09-28 10:46:31	2023-09-28 10:46:31
3	Products	fa-regular fa-cart-plus	admin.products.index	2023-09-28 10:46:31	2023-09-28 10:46:31

Roles (roles)

id	name	guard_name	created_at	updated_at
1	admin	web	2023-09-28 10:46:31	2023-09-28 10:46:31
2	member	web	2023-09-28 10:46:31	2023-09-28 10:46:31

Permissions (permissions)

id	name	guard_name	created_at	updated_at
1	view-products	web	2023-09-28 10:46:31	2023-09-28 10:46:31
2	view-analytics	web	2023-09-28 10:46:31	2023-09-28 10:46:31

Role Has Permissions (roles_has_permissions)

permission_id	role_id
1	1
2	1

Now this obviously means the role admin has the permissions view-products and view-analytics.

Now what's the best way to attach a role or permissions to these modules ?
I assume I have to go to the model_has_permissions and add:

role_id	model_type	model_id
1	App\Models\Modules	2
1	App\Models\Modules	3

I know I'll have to add a relationship in the User.php model,

// Rest of model
class User
{
    // Rest of model
    public function navigation()
    {
        // Get navigation items based on role/permissions
    }
    // Rest of model
}

But I am unsure what the best relation would be between the Models for me to do something like:

$userNavigation = auth()->user()->navigation();

is it a hasManyTrough ? Or is there a better solution and should I create something like a Service or Trait for this ?

This will be added in the HandleInertiaRequests/ShareInertiaData so the menu gets fetched every page change.

[drbyte]

I think you're overcomplicating it.
And you're not using this package as it's designed.

This package is to provide authorization responses for Users (er, models which implement Laravel's Authorizable contract). Not for other objects.

You talked about linking Models via the model_has_permissions table. I don't think that makes sense.
Instead, I'd suggest that your Module models use a Policy to check for whether a User is allowed to use/see certain things that the Module provides. The Policy can then make any checks to authorize()/can() on behalf of the User, meaning your Module models simply call the Policy methods where needed. That way your View layer can also leverage the Policy responses via the Module models.

[Twyar]

Guess you're right, I wasn't in the right mindset or something.

id	module_id	icon	name	route	permission_id	order	created_at	updated_at
1	NULL	NULL	Dashboard	admin.dashboard.index	NULL	NULL	2023-10-04 11:08:31	2023-10-04 11:08:31
2	NULL	users	Users	admin.users.index	1	NULL	2023-10-04 11:11:10	2023-10-04 11:20:19
3	2	user-plus	Create users	admin.users.create	2	NULL	2023-10-04 11:12:41	2023-10-04 11:21:31

Decided to do something simple like this without a Policy. Store the permission id inside the modules table.

Then I have a resource called AuthenticatedUserResource
Which has the following.

class AuthenticatedUserResource extends JsonResource
{
    /**
     * Transform the resource into an array.
     *
     * @return array<string, mixed>
     */
    public function toArray(Request $request): array
    {
        return [
            // Rest of data
            'modules' =>  Module::parents()->where(function ($query) {
                $permissionIds = auth()->user()->getPermissionsViaRoles()->pluck('id');
                $query->orWhereNull('permission_id');
                $query->orWhereIn('permission_id', $permissionIds);
            })
            ->orderBy('order')
            ->get(),
        ];
    }
}

This successfully returns all modules for the user based on permissions.

Ofcourse I am still using Policies to protect the backend so people can't just edit stuff. This was mainly to port to the front-end with Inertia/Vue3 to display the navigation based on these permissions as well.