Laravel Roles and Permissions Using Spatie

$(document).ready(function() {
    $("#checkDefaultmain").on("click", function() {
        $(".custom-control-input").not(this).prop("checked", $(this).prop("checked"));
    });

    $(".group-checkbox").on("click", function() {
        let groupId = $(this).data("group-id");
        $(".permission-checkbox[data-group-id='" + groupId + "']")
            .prop("checked", $(this).prop("checked"));
    });
});

✅ Explanation:

• “All Permissions” checkbox selects or deselects all.

• Group checkboxes handle all permissions in one group.

Roles With Permissions CRUD

  // Roles and Permissions

    public function all_roles_permissions()
    {
        $data['roles'] = Role::all();
        $data['permission_groups'] = Admin::getPermissionGroups();
        return view('adminpanel.adminuser.roles_permissions.add', $data);
    }

    public function store_roles_permissions(Request $request)
    {
        try {
            $request->validate([
                'role_id' => 'required',
                'permission' => 'required|array', // Ensure permission is an array
                'permission.*' => 'exists:permissions,id', // Validate each permission in the array
            ]);

            $role_id = $request->role_id;
            $permissions = $request->permission;

            // Check if the role already has permissions
            $existingPermissions = DB::table('role_has_permissions')
                ->where('role_id', $role_id)
                ->pluck('permission_id')
                ->toArray();

            // Compare the existing permissions with the ones being added
            $conflictingPermissions = array_intersect($permissions, $existingPermissions);

            if (!empty($conflictingPermissions)) {
                toastr()->error('The selected Role already has some permissions! Kindly Update');
            } else {
                foreach ($permissions as $permission_id) {
                    // Insert the new entry
                    DB::table('role_has_permissions')->insert([
                        'role_id' => $role_id,
                        'permission_id' => $permission_id,
                    ]);
                }
                toastr()->Success('Permissions assigned to the selected role Successfully');
            }
            return redirect()->route('show.roles.permissions');
        } catch (\Throwable $th) {
            toastr()->error($th->getMessage());
            return redirect()->back();
        }
    }


    public function show_roles_permissions()
    {
        $data['all_roles'] = Role::all();
        return view('adminpanel.adminuser.roles_permissions.show_roles_permissions', $data);
    }

    public function edit_roles_permissions($id)
    {
        $data['role'] = Role::findOrFail($id);
        $data['permissions'] = Permission::all();
        $data['permission_groups'] = Admin::getPermissionGroups();
        return view('adminpanel.adminuser.roles_permissions.edit', $data);
    }

    public function update_roles_permissions(request $request, $id)
    {
        // dd($request->all());
        $role = Role::findOrFail($id);
        $permissions = $request->permission;

        if (!empty($permissions)) {
            $role->syncPermissions($permissions);
        }
        toastr()->success('Permissions updated Successfully');
        return redirect()->route('show.roles.permissions');
    }

    public function delete_roles_permissions($id)
    {
        $role = Role::findOrFail($id);
        if (!is_null($role)) {
            $role->delete();
        }
        toastr()->success('Permissions Deleted Successfully');
        return redirect()->back();
    }
}

👨‍💼 Step 8: Assign Roles to Admin Users

In your AdminUserController:

public function add()
{
    $data['roles'] = Role::all();
    return view('adminpanel.adminuser.add', $data);
}

public function store(Request $request)
{
    $request->validate([
        'first_name' => 'required|max:30',
        'last_name' => 'required|max:30',
        'username' => 'required|unique:admins|max:30',
        'email' => 'required|email|unique:admins',
        'password' => 'required|min:8|confirmed',
        'role' => 'required',
    ]);

    $admin = new Admin();
    $admin->first_name = $request->first_name;
    $admin->last_name = $request->last_name;
    $admin->email = $request->email;
    $admin->username = $request->username;
    $admin->password = Hash::make($request->password);
    $admin->save();

    $role = Role::find($request->role);
    $admin->assignRole($role);

    toastr()->success('Admin user created and role assigned successfully!');
    return redirect()->route('admin.user.show');
}

✅ Explanation:

• Each admin is assigned a specific role at creation.

• This role automatically gives them access to assigned permissions.

🔐 Step 9: Restrict Page Access with Middleware

You can now protect routes using Spatie’s middleware.

In your routes/admin.php:

Route::get('/show', [AdminUserController::class, 'show'])
    ->name('admin.user.show')
    ->middleware('checkPermission:show_admin_user');

✅ This ensures only users with the show_admin_user permission can view this route.

🧭 Step 10: Blade Conditional Access

In your Blade templates, you can restrict UI elements using permission checks:

@if (Auth::guard('admin')->user()->can('access_cms_panel'))
    <li class="nk-menu-item">
        <a href="{{ route('cms.dashboard') }}" class="nk-menu-link" title="CMS Panel">
            <span class="nk-menu-icon"><em class="icon ni ni-template"></em></span>
        </a>
    </li>
@endif

If the admin has the access_cms_panel permission, they’ll see this menu — otherwise, it stays hidden.

Conclusion

You’ve now built a complete Roles and Permissions Management System in Laravel using Spatie!
Your admin panel is now secure, modular, and easy to maintain.

With this setup, you can:

• Add new roles anytime,

• Assign specific permissions easily,

• Protect routes, menus, and actions dynamically.