Overridable controllers, policies and default permissions (RBAC, multi-auth)

Controllers overridable from config or the container
Routes registered by a macro so apps choose prefix, middleware and guard
Nothing assumes the web guard or App\Models\User
A Policy and default permissions registered through javaabu/permissions' registration API
Policies overridable from config or Gate::policy()
Feature tests for authorization and for two guards

Admin pages, route macros, policies and permissions for every locatio…

Done:

Routes: Route::locations() takes guard, prefix, name, middleware (default auth:{guard}), only, except and controllers. The guard is stored in the route action, as Route::roles() does.
Controllers: one per type on LocationsController, overridable from config.
Permissions: view_/edit_/delete_{countries,states,cities,atolls,islands}, registered through javaabu/permissions.
Policies: on ResourcePolicy, overridable with config('permissions.policies') or Gate::policy(). Subclasses (app models, translatable variants) are covered.
Tests: feature tests cover authorization per ability and two guards (web → User, web_admin → Admin).

Decision: a location with children isn't deleted (409 / a flashed error), and the foreign keys restrict deletes.

Navigation Menu