Building a Role-Based Access Control (RBAC) in Laravel 12

Role-Based Access Control (RBAC) is an essential feature for managing user permissions in web applications. It allows you to assign different roles to users (e.g., Admin, Editor, User) and grant permissions accordingly.

In this tutorial, we will implement RBAC in Laravel 12 using spatie/laravel-permission package to manage roles and permissions efficiently.

What You’ll Learn

✅ Install and configure Spatie's Laravel Permission package
✅ Create roles and permissions
✅ Assign roles to users
✅ Restrict access based on roles

Step 1: Install Laravel 12

If you don’t have Laravel installed, create a new Laravel 12 project

composer create-project laravel/laravel rbac-system
cd rbac-system

Run the Laravel development server:

php artisan serve

Step 2: Install Spatie Laravel Permission Package

The Spatie Laravel Permission package helps manage roles and permissions easily. Install it using Composer:

composer require spatie/laravel-permission

Now, publish the package configuration file:

php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"

Run migrations to create the required tables:

php artisan migrate

Step 3: Add Roles and Permissions to the User Model

Modify the User model (app/Models/User.php) and add the HasRoles trait:

namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable
{
    use HasFactory, HasRoles;
}

Step 4: Create Roles and Permissions

To create roles and permissions, add the following logic in a seeder.

Run this command to create a new seeder:

php artisan make:seeder RoleSeeder

Now, update the database/seeders/RoleSeeder.php file:

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use Spatie\Permission\Models\Role;
use Spatie\Permission\Models\Permission;

class RoleSeeder extends Seeder
{
    public function run()
    {
        // Create roles
        $admin = Role::create(['name' => 'admin']);
        $editor = Role::create(['name' => 'editor']);
        $user = Role::create(['name' => 'user']);

        // Create permissions
        Permission::create(['name' => 'create posts']);
        Permission::create(['name' => 'edit posts']);
        Permission::create(['name' => 'delete posts']);

        // Assign permissions to roles
        $admin->givePermissionTo(['create posts', 'edit posts', 'delete posts']);
        $editor->givePermissionTo(['create posts', 'edit posts']);
        $user->givePermissionTo(['create posts']);
    }
}

Step 5: Assign Roles to Users

To assign roles to users, update routes/web.php:

use App\Models\User;
use Spatie\Permission\Models\Role;
use Illuminate\Support\Facades\Route;

Route::get('/assign-role', function () {
    $user = User::find(1); // Change the ID to the user you want to assign the role to
    $user->assignRole('admin');

    return "Role assigned successfully!";
});

Step 6: Middleware for Role-Based Access Control

Now, create middleware to restrict access based on roles.

Run this command to create middleware:

php artisan make:middleware RoleMiddleware

Modify app/Http/Middleware/RoleMiddleware.php:

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class RoleMiddleware
{
    public function handle(Request $request, Closure $next, $role)
    {
        if (!Auth::check() || !Auth::user()->hasRole($role)) {
            abort(403, 'Unauthorized Access');
        }

        return $next($request);
    }
}

Step 7: Apply Middleware to Routes

Modify routes/web.php to restrict access based on roles:

use App\Http\Controllers\AdminController;

Route::middleware(['auth', 'role:admin'])->group(function () {
    Route::get('/admin', [AdminController::class, 'index']);
});

Step 8: Check Roles in Blade Views

You can also check user roles in Blade templates:

@if(auth()->user()->hasRole('admin'))
    <p>Welcome, Admin!</p>
@endif

Conclusion

In this tutorial, we successfully built Role-Based Access Control (RBAC) in Laravel 12. We covered:
✅ Installing and configuring Spatie's Permission package
✅ Creating roles and permissions
✅ Assigning roles to users
✅ Restricting access using middleware

This setup allows you to create flexible access control in any Laravel application. 🚀