Multi-tier users/roles/permissions

[kvveltho]

Hello,

Do you have a multi-tier users/roles/permissions feature? I need a global admin who can assign different users that will each have their own control panel with their own users to manage.

Suggestions?

Thanks.

[karandatwani92]

Hey @kvveltho

Yes Backpack has RBAC support.

Addon: https://github.com/Laravel-Backpack/PermissionManager

Tutorial: https://backpackforlaravel.com/articles/tutorials/guide-on-access-control-for-your-admin-panel

[kvveltho]

Hello, ok but we need multi-tier. Your permission manager is not multi-tier.

[karandatwani92]

Do you mean store/city based? Sorry, this is not covered.

You have to make it by yourself.

[o15a3d4l11s2]

I would suggest that you use the PermissionManager plugin and modify it slightly.

Here is an overview of a possible solution:

1. Extend the user model to have the necessary information you need to "group" users so that you know which admin has control over which users
2. Modify https://github.com/Laravel-Backpack/PermissionManager/blob/main/src/app/Http/Controllers/UserCrudController.php so that it checks if the user is a super-admin or a regular admin.
   1. If the user is super-admin, then allow them everything.
   2. If the user is admin, then apply a clause: https://backpackforlaravel.com/docs/6.x/crud-api#custom-advanced-queries to only show entries related to the current admin. If you have different actions, then add a condition for showing/hiding them based on the user access level too.
   3. Be sure to protect direct access to actions based on the admin (you do not want to allow admins to freely write url for editing a user that is not under their control and allow the editing). For this you can utilise the spatie/laravel-permission package itself (allow modifications based on roles and permissions).

I think this should be sufficient to have the same CRUD, but with conditional functionality so a super-admin can do everything, but regular admins would see and have permission to edit only a portion of the users.