Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement advanced authorization checks using roles and policies #106

Merged
merged 7 commits into from
Mar 10, 2021

Conversation

danharrin
Copy link
Member

@danharrin danharrin commented Mar 7, 2021

This PR adds support for advanced authorization control in Filament.

Filament provides three levels of authorization. Each is checked, in this order. If one level is not present, it is ignored:

  • Filament admin users will have complete control over all data available in your Filament panel.
  • Roles allow basic control over access to pages, resources and the actions that take place within them.
  • Model policies extend the same feature set as roles, as well as providing record-specific control over user access to certain actions.

Example advanced authorization using roles

public static function authorization()
{
    return [
        Roles\Guest::allow()->only('viewAny'),
        Roles\Employee::allow()->except('delete'),
        Roles\Manager::allow(),
    ];
}

@danharrin danharrin added the enhancement New feature or request label Mar 7, 2021
@kfvit-andreaskviby
Copy link

Hey, just a thought from Mr Kviby here :) I would like to add if the record is viewable at all for the currently logged in user.

@ryangjchandler
Copy link
Member

Hey, just a thought from Mr Kviby here :) I would like to add if the record is viewable at all for the currently logged in user.

You would be able to do this using a model policy or using one of Filament's roles.

@danharrin danharrin marked this pull request as draft March 9, 2021 21:10
@danharrin danharrin marked this pull request as ready for review March 10, 2021 02:19
Co-authored-by: Ryan Chandler <ryangjchandler@gmail.com>
@danharrin danharrin merged commit c26a954 into develop Mar 10, 2021
@danharrin danharrin deleted the feature/authorization branch March 10, 2021 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants