laravel4cookbook

Access Control List 68
All the “insecure” routes are rendered in the first block — the block in which routes are subject to the
guest filter. All the “secure” routes are rendered in the secure; where they are subject to the auth
filter.
1 Route::filter("auth", function()
2 {
3 if (Auth::guest())
4 {
5 return Redirect::route("user/login");
6 }
7 else
8 {
9 foreach (Auth::user()->groups as $group)
10 {
11 foreach ($group->resources as $resource)
12 {
13 $path = Route::getCurrentRoute()->getPath();
14
15 if ($resource->pattern == $path)
16 {
17 return;
18 }
19 }
20 }
21
22 return Redirect::route("user/login");
23 }
24 });
.
This was extracted from app/filters.php.
The new auth filter needs not only to make sure the user is authenticated, but also that one of
the group to which they are assigned has the current route assigned to it also. Users can belong to
multiple groups and so can resources; so this is the only (albeit inefficient way) to filter allowed
resources from those which the user is not allowed access to.
To test this out; alter the group to which your user account belongs to disallow access to the
group/add route. When you try to visit it you will be redirected first to the user/login route and
the not the user/profile route.