Global administrator, allowing all permissions

[Naamloos]

Hi!

I am currently working on a project that uses Laratrust, and I was wondering if it was possible to define a role that automatically gets all allowed permissions?

Currently our system solves this by having a copy of every permission prefixed with superadmin-. I'd like to change that to a simple boolean on a role that when set to true will return success on any permission check.

Is something like this possible natively with Laratrust? I had considered overriding some methods on the LaratrustUserTrait trait, but quickly figured out that that might not be the best way?

Thank you in advance!

(This project uses laratrust 6.1.0)

[filippotoso]

Intercept the created event in the Permission model and attach the created permission to the superadmin role.

[Naamloos]

I don't think this quite suffices as a proper solution to this problem. It sounds more like a workaround than a proper solution.

(Thank you for your response anyway, I appreciate the effort)

[filippotoso]

Without modifing Laratrust behaviour there are only 2 ways to do what you need.

The first one is to keep the SuperAdmin role permissions in sync with all the available permissions (see above for the implementation)

The second one is to add a check for the SuperAdmin role everytime you check for permissions (ie. if the user has this permission OR he has the SuperAdmin role).

Otherwise, you have to change the Laratrust behaviour to check for the single permission OR check for the SuperAdmin role.

From my point of view, the first solution is the easiest and cleanest of all of them.

[Naamloos]

I am not entirely sure if this would work, but after some digging, perhaps it'd be possible to override the hasPermission method on my User class that implements the LaratrustUserTrait?

Wouldn't that hide away the trait's method for my own implementation? Since class methods take precedence over trait methods.

Correct me if I'm wrong of course, but isn't that a possible solution?

[santigarcor]

How I've made it in the past is by defining one permission that only super admins have and in side the policies i check if the user has that permission or the actually required permission. or by simply adding all the permissions to the admin.

[Naamloos]

even though it's not exactly the solution I was looking for, it is a better solution than what was proposed before, in my honest opinion. Thank you both for your help. I'll propose this change internally.