本文使用 Laravel 的 Gate 授权方式 实现一个基于用户角色的博客发布系统。
在系统包含两个用户角色（作者 和 编辑），它们对应的角色权限如下：
- 作者能创建博客
- 作者能更新自己的博客
- 作者能发布/不发布自己的博客
- 作者能删除自己的博客
- 编辑能更新所有博客
- 编辑能发布/不发布所有博客
- 编辑能删除所有博客
创建项目
laravel new blog
> php artisan -V
Laravel Framework 5.4.21
或者使用 composer create-project
composer create-project --prefer-dist laravel/laravel blog
配置数据库连接
修改 .env 文件中的数据库连接信息。
...
APP_URL=http://localhost
...
DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=dbname
DB_USERNAME=dbuser
DB_PASSWORD=yoursecretdbuserpassword
...
数据库部分
创建 Post Model、Post 迁移文件和 Post 控制器。
> php artisan make:model Post -m -c
Model created successfully.
Created Migration: 2017_05_07_083335_create_posts_table
Controller created successfully.
打开迁移文件，补充 up 方法。
Schema::create('posts', function (Blueprint $table) {
$table->increments('id');
$table->string('title');
$table->string('slug')->unique();
$table->text('body');
$table->boolean('published')->default(false);
$table->unsignedInteger('user_id');
$table->timestamps();
$table->foreign('user_id')->references('id')->on('users');
});
添加 roles 表和关系表 user_roles。
-
roles表
创建 Role Model 和 Role 迁移文件
> php artisan make:model Role -m
Model created successfully.
Created Migration: 2017_05_07_083537_create_roles_table
打开迁移文件，补充 up 方法。
Schema::create('roles', function (Blueprint $table) {
$table->increments('id');
$table->string('name');
$table->string('slug')->unique();
$table->jsonb('permissions'); // jsonb deletes duplicates
$table->timestamps();
});
-
user_roles表
创建迁移文件
php artisan make:migration create_user_roles_table --create=user_roles
补充 up 方法
public function up()
{
Schema::create('user_roles', function (Blueprint $table) {
$table->unsignedInteger('user_id');
$table->unsignedInteger('role_id');
$table->timestamps();
$table->unique(['user_id','role_id']);
$table->foreign('user_id')->references('id')->on('users')->onDelete('cascade');
$table->foreign('role_id')->references('id')->on('roles')->onDelete('cascade');
});
}
public function down()
{
Schema::dropIfExists('user_roles');
}
种子类
创建 RolesTableSeeder。
php artisan make:seeder RolesTableSeeder
补充 run 方法。
use App\Role;
class RolesTableSeeder extends Seeder
{
public function run()
{
$author = Role::create([
'name' => '作家',
'slug' => 'author',
'permissions' => [
'create-post' => true,
]
]);
$editor = Role::create([
'name' => '编辑',
'slug' => 'editor',
'permissions' => [
'update-post' => true,
'publish-post' => true,
'delete-post' => true,
]
]);
}
}
在 DatabaseSeeder 中注册 RolesTableSeeder。
$this->call(RolesTableSeeder::class);
User 和 Role Model
添加 Role Model 的内容。
class Role extends Model
{
protected $fillable = [
'name', 'slug', 'permissions',
];
protected $casts = [
'permissions' => 'array',
];
public function users()
{
return $this->belongsToMany(User::class, 'user_roles', 'role_id', 'user_id');
}
public function hasAccess($permission)
{
return $this->hasPermission($permission);
}
private function hasPermission($permission)
{
return isset($this->permissions[$permission]) ? $this->permissions[$permission] : false;
}
}
添加 User Model 的内容。
class User extends Authenticatable
{
use Notifiable;
protected $fillable = [
'name', 'email', 'password',
];
protected $hidden = [
'password', 'remember_token',
];
public function roles()
{
return $this->belongsToMany(Role::class, 'user_roles', 'user_id', 'role_id');
}
/**
* Checks if User has access to $permission.
*/
public function hasAccess($permission)
{
// check if the permission is available in any role
foreach ($this->roles as $role) {
if($role->hasAccess($permission)) {
return true;
}
}
return false;
}
/**
* Checks if the user belongs to role.
*/
public function inRole($roleSlug)
{
return $this->roles()->where('slug', $roleSlug)->count() == 1;
}
}
执行迁移和数据注入
php artisan migrate --seed
认证系统
> php artisan make:auth
Authentication scaffolding generated successfully.
注册
在 Controllers/Auth/RegisterController.php 创建 showRegistrationForm 方法（覆盖掉在 RegistersUsers trait 中定义）。
Use App/Role;
...
public function showRegistrationForm()
{
$roles = Role::orderBy('name')->pluck('name', 'id');
return view('auth.register', compact('roles'));
}
编辑 resources/views/auth/register.blade.php，添加角色选择项。
...
<div class="form-group{{ $errors->has('role') ? ' has-error' : '' }}">
<label for="role" class="col-md-4 control-label">User role</label>
<div class="col-md-6">
<select id="role" class="form-control" name="role" required>
@foreach($roles as $id => $role)
<option value="{{ $id }}">{{ $role }}</option>
@endforeach
</select>
@if ($errors->has('role'))
<span class="help-block">
<strong>{{ $errors->first('role') }}</strong>
</span>
@endif
</div>
</div>
...
更新 RegisterController 中的 validator 方法。
...
protected function validator(array $data)
{
return Validator::make($data, [
'name' => 'required|max:255',
'email' => 'required|email|max:255|unique:users',
'password' => 'required|min:6|confirmed',
'role' => 'required|exists:roles,id', // validating role
]);
}
...
修改 create 方法，加入存储用户角色的业务逻辑。
...
protected function create(array $data)
{
$user = User::create([
'name' => $data['name'],
'email' => $data['email'],
'password' => bcrypt($data['password']),
]);
$user->roles()->attach($data['role']);
return $user;
}
...
运行项目
浏览器地址栏输入： http://localhost/blog/public/ 。看到欢迎页面、注册用户。
定义策略
修改 app/Providers/AuthServiceProvider.php 文件。
use App\Post;
...
public function boot()
{
$this->registerPolicies();
$this->registerPostPolicies();
}
public function registerPostPolicies()
{
Gate::define('create-post', function ($user) {
return $user->hasAccess('create-post');
});
Gate::define('update-post', function ($user, Post $post) {
return $user->hasAccess('update-post') or $user->id == $post->user_id;
});
Gate::define('publish-post', function ($user, Post $post) {
return $user->hasAccess('publish-post') or $user->id == $post->user_id;;
});
Gate::define('delete-post', function ($user, Post $post) {
return $user->hasAccess('delete-post') or $user->id == $post->user_id;
});
Gate::define('see-all-drafts', function ($user) {
return $user->inRole('editor');
});
}
定义路由
修改 routes/web.php。
Route::get('/posts', 'PostController@index')->name('list_posts');
Route::group(['prefix' => 'posts'], function () {
Route::get('/drafts', 'PostController@drafts')
->name('list_drafts')
->middleware('auth');
Route::get('/show/{id}', 'PostController@show')
->name('show_post');
Route::get('/create', 'PostController@create')
->name('create_post')
->middleware('can:create-post');
Route::post('/create', 'PostController@store')
->name('store_post')
->middleware('can:create-post');
Route::get('/edit/{post}', 'PostController@edit')
->name('edit_post')
->middleware('can:update-post,post');
Route::post('/edit/{post}', 'PostController@update')
->name('update_post')
->middleware('can:update-post,post');
Route::post('/delete/{post}', 'PostController@destory')
->name('delete_post')
->middleware('can:delete-post,post');
// using get to simplify
Route::get('/publish/{post}', 'PostController@publish')
->name('publish_post,post')
->middleware('can:publish-post');
Route::get('/unpublish/{post}', 'PostController@unpublish')
->name('unpublish_post')
->middleware('can:publish-post,post');
});
博客
Post Model
...
class Post extends Model
{
protected $fillable = [
'title', 'slug', 'body', 'user_id',
];
public function owner()
{
return $this->belongsTo(User::class);
}
public function scopePublished($query)
{
return $query->where('published', true);
}
public function scopeUnpublished($query)
{
return $query->where('published', false);
}
}
PostController
博客列表
use App\Post;
...
public function index()
{
$posts = Post::published()->latest()->paginate();
return view('posts.index', compact('posts'));
}
...
创建 resources/views/posts/index.blade.php
@extends('layouts.app')
@section('content')
<div class="container">
<div class="row">
<div class="col-md-8 col-md-offset-2">
<div class="panel panel-default">
<div class="panel-heading">
Posts
@can('create-post')
<a class="pull-right btn btn-sm btn-primary" href="{{ route('create_post') }}">New</a>
@endcan
</div>
<div class="panel-body">
<div class="row">
@foreach($posts as $post)
<div class="col-sm-6 col-md-4">
<div class="thumbnail">
<div class="caption">
<h3><a href="{{ route('show_post', ['id' => $post->id]) }}">{{ $post->title }}</a></h3>
<p>{{ str_limit($post->body, 50) }}</p>
@can('update-post', $post)
<p>
<a href="{{ route('edit_post', ['id' => $post->id]) }}" class="btn btn-sm btn-default" role="button">Edit</a>
</p>
@endcan
</div>
</div>
</div>
@endforeach
</div>
</div>
</div>
</div>
</div>
</div>
@endsection
创建博客
...
public function create()
{
return view('posts.create');
}
...
创建 posts\create.blade.php。
@extends('layouts.app')
@section('content')
<div class="container">
<div class="row">
<div class="col-md-8 col-md-offset-2">
<div class="panel panel-default">
<div class="panel-heading">New Post</div>
<div class="panel-body">
<form class="form-horizontal" role="form" method="POST" action="{{ route('store_post') }}">
{{ csrf_field() }}
<div class="form-group{{ $errors->has('title') ? ' has-error' : '' }}">
<label for="title" class="col-md-2 control-label">Title</label>
<div class="col-md-9">
<input id="title" type="text" class="form-control" name="title" value="{{ old('title') }}" required autofocus>
@if ($errors->has('title'))
<span class="help-block">
<strong>{{ $errors->first('title') }}</strong>
</span>
@endif
</div>
</div>
<div class="form-group{{ $errors->has('body') ? ' has-error' : '' }}">
<label for="body" class="col-md-2 control-label">Body</label>
<div class="col-md-9">
<textarea name="body" id="body" cols="30" rows="10" class="form-control" required>{{ old('body') }}</textarea>
@if ($errors->has('body'))
<span class="help-block">
<strong>{{ $errors->first('body') }}</strong>
</span>
@endif
</div>
</div>
<div class="form-group">
<div class="col-md-6 col-md-offset-2">
<button type="submit" class="btn btn-primary">
Create
</button>
<a href="{{ route('list_posts') }}" class="btn btn-primary">
Cancel
</a>
</div>
</div>
</form>
</div>
</div>
</div>
</div>
</div>
@endsection
保存博客
use Auth;
use App\Http\Requests\StorePost as StorePostRequest;
...
public function store(StorePostRequest $request)
{
$data = $request->only('title', 'body');
$data['slug'] = str_slug($data['title']);
$data['user_id'] = Auth::user()->id;
$post = Post::create($data);
return redirect()->route('edit_post', ['id' => $post->id]);
}
...
创建处理存储博客时使用的请求类 StorePostRequest。
php artisan make:request StorePostRequest
编辑 app/Http/Requests/StorePost.php。
public function authorize()
{
return true; // gate will be responsible for access
}
public function rules()
{
return [
'title' => 'required|unique:posts',
'body' => 'required',
];
}
博客草稿列表
use Gate;
...
public function drafts()
{
$postsQuery = Post::unpublished();
if(Gate::denies('see-all-drafts')) {
$postsQuery = $postsQuery->where('user_id', Auth::user()->id);
}
$posts = $postsQuery->paginate();
return view('posts.drafts', compact('posts'));
}
...
创建 posts/drafts.blade.php。
@extends('layouts.app')
@section('content')
<div class="container">
<div class="row">
<div class="col-md-8 col-md-offset-2">
<div class="panel panel-default">
<div class="panel-heading">
Drafts <a class="btn btn-sm btn-default pull-right" href="{{ route('list_posts') }}">Return</a>
</div>
<div class="panel-body">
<div class="row">
@foreach($posts as $post)
<div class="col-sm-6 col-md-4">
<div class="thumbnail">
<div class="caption">
<h3><a href="{{ route('show_post', ['id' => $post->id]) }}">{{ $post->title }}</a></h3>
<p>{{ str_limit($post->body, 50) }}</p>
<p>
@can('publish-post', $post)
<a href="{{ route('publish_post', ['id' => $post->id]) }}" class="btn btn-default" role="button">Publish</a>
@endcan
<a href="{{ route('edit_post', ['id' => $post->id]) }}" class="btn btn-default" role="button">Edit</a>
</p>
</div>
</div>
</div>
@endforeach
<div class="col-sm-12 col-md-12">
{{ $posts->links() }}
</div>
</div>
</div>
</div>
</div>
</div>
</div>
@endsection
修改 layouts/app.blade.php，添加“草稿”菜单。
...
<ul class="dropdown-menu" role="menu">
<li>
<a href="{{ route('list_drafts') }}">Drafts</a>
...
编辑博客
添加编辑博客的方法 update。
use App\Http\Requests\UpdatePostRequest as UpdatePostRequest;
...
public function edit(Post $post)
{
return view('posts.edit', compact('post'));
}
public function update(Post $post, UpdatePostRequest $request)
{
$data = $request->only('title', 'body');
$data['slug'] = str_slug($data['title']);
$post->fill($data)->save();
return back();
}
创建处理更新博客时使用的请求类 UpdatePostRequest。
php artisan make:request UpdatePostRequest
编辑 app/Http/Requests/UpdatePostRequest.php
use Illuminate\Validation\Rule;
...
public function authorize()
{
return true;
}
public function rules()
{
$id = $this->route('post')->id;
return [
'title' => [
'required',
Rule::unique('posts')->where('id', '<>', $id),
],
'body' => 'required',
];
}
创建视图 posts/edit.blade.php。
@extends('layouts.app')
@section('content')
<div class="container">
<div class="row">
<div class="col-md-8 col-md-offset-2">
<div class="panel panel-default">
<div class="panel-heading">Update Post</div>
<div class="panel-body">
<form class="form-horizontal" role="form" method="POST" action="{{ route('update_post', ['post' => $post->id]) }}">
{{ csrf_field() }}
<div class="form-group{{ $errors->has('title') ? ' has-error' : '' }}">
<label for="title" class="col-md-2 control-label">Title</label>
<div class="col-md-9">
<input id="title" type="text" class="form-control" name="title" value="{{ old('title', $post->title) }}" required autofocus>
@if ($errors->has('title'))
<span class="help-block">
<strong>{{ $errors->first('title') }}</strong>
</span>
@endif
</div>
</div>
<div class="form-group{{ $errors->has('body') ? ' has-error' : '' }}">
<label for="body" class="col-md-2 control-label">Body</label>
<div class="col-md-9">
<textarea name="body" id="body" cols="30" rows="10" class="form-control" required>{{ old('body', $post->body) }}</textarea>
@if ($errors->has('body'))
<span class="help-block">
<strong>{{ $errors->first('body') }}</strong>
</span>
@endif
</div>
</div>
<div class="form-group">
<div class="col-md-6 col-md-offset-2">
<button type="submit" class="btn btn-primary">
Update
</button>
@can('publish-post', $post)
@if (!$post->published)
<a href="{{ route('publish_post', ['post' => $post->id]) }}" class="btn btn-primary">
Publish
</a>
@else
<a href="{{ route('unpublish_post', ['post' => $post->id]) }}" class="btn btn-primary">
Unpublish
</a>
@endif
@endcan
<a href="{{ route('list_posts') }}" class="btn btn-primary">
Cancel
</a>
</div>
</div>
</form>
</div>
</div>
</div>
</div>
</div>
@endsection
发布草稿/不发布草稿
为 PostController 添加方法 publish 和 unpublish。
...
public function publish(Post $post)
{
$post->published = true;
$post->save();
return redirect()->route('show_post', ['post' => $post->id]);
}
public function unpublish(Post $post)
{
$post->published = false;
$post->save();
return back();
}
...
展示博客
public function show(Post $post)
{
$post = Post::findOrFail($id);
if ($post->published || $post->user_id == Auth::user()->id) {
return view('posts.show', compact('post'));
}
abort(403, 'Unauthorized.');
}
创建 posts/show.blade.php。
@extends('layouts.app')
@section('content')
<div class="container">
<div class="row">
<div class="col-md-8 col-md-offset-2">
<div class="panel panel-default">
<div class="panel-heading">
{{ $post->title }}
<a class="btn btn-sm btn-default pull-right" href="{{ route('list_posts') }}">Return</a>
</div>
<div class="panel-body">
{{ $post->body }}
</div>
</div>
</div>
</div>
</div>
@endsection
删除博客
修改 PostController，添加 destory 方法。
public function destory(Post $post)
{
$post->delete();
return redirect()->route('list_post');;
}
修改 posts/edit.blade.php，添加删除按钮。
...
<div class="panel-heading">Update Post
@can('delete-post', $post)
<a class="pull-right btn btn-sm btn-danger" href="{{ route('delete_post', ['id' => $post->id]) }}"
onclick="if(confirm('确定删除吗？') === false) { return false; } else {
event.preventDefault(); document.getElementById('delete-post-form').submit();}">
删除
</a>
<form id="delete-post-form" action="{{ route('delete_post', ['post' => $post->id]) }}" method="POST" style="display: none;">
{{ csrf_field() }}
</form>
@endcan
</div>
...
404 & 403
在 resources/views 下新建 errors 目录，再在该目录下新建 404.blade.php 和 403.blade.php 页面。
404
@extends('layouts.app')
@section('content')
<div class="container">
<div class="row">
<div class="col-md-8 col-md-offset-2">
<div class="panel panel-default">
<div class="panel-heading">404</div>
<div class="panel-body">
<h2>Not Found</h2>
</div>
</div>
</div>
</div>
</div>
@endsection
403
@extends('layouts.app')
@section('content')
<div class="container">
<div class="row">
<div class="col-md-8 col-md-offset-2">
<div class="panel panel-default">
<div class="panel-heading">403</div>
<div class="panel-body">
<h2>This Action is Unauthorized！</h2>
</div>
</div>
</div>
</div>
</div>
@endsection
使用 Markdown
这里要安装依赖包 erusev/parsedown，使用它将 Markdown 文本装换为 HTML。
composer require erusev/parsedown
修改 posts/show.blade.php
<div class="panel-body">
{!! Parsedown::instance()->text($post->body) !!}
</div>
此刻，你就可以使用 Markdown 写博客了。