livewire usage teams permissions gives 403 error when changing model, click or submit.

[gzai]

Hello all,

I have livewire with spatie teams permissions. When using an account with a specific role opening page is successful, but when I change any input or click submit, give error 403. Any suggest?

Info :

• Laravel 9.12.2
• livewire 2.10.5
• spatie permission 5.5.4

[erikn69]

Did you add a middleware for setting setPermissionTeamId?

[erikn69]

Example
#2075
working-with-teams-permissions

Look other discussions, there is more info about team session, this one for example #1906 (reply in thread)

[gzai]

yes, I've added a middleware for setting setPermissionTeamId

<?php

namespace App\Http\Middleware;

class AgencyPermission 
{    
    public function handle($request, \Closure $next) 
    {
        if ( auth()->user() ) 
        {
            // session value set on login
            setPermissionsTeamId( session('agency_id') );
        }

        // other custom ways to get team_id
        /*if (!empty(auth('api')->user()))
        {
            // `getTeamIdFromToken()` example of custom method for getting the set team_id 
            setPermissionsTeamId(auth('api')->user()->getTeamIdFromToken());
        }*/
        
        return $next($request);
    }
}

kernel :

protected $routeMiddleware = [
    ...
    'agency_permission' => \App\Http\Middleware\AgencyPermission::class,
]

route :

Route::prefix('panels')->name('panels.')->group(function () {

    Route::get('dashboard', DashboardFrontend::class)
        ->name('dashboard');

    Route::prefix('agency/{agency}')->name('agency.')->middleware(['agency_permission'])->group(function () {
        
        Route::get('/', AgencyDashboardFrontend::class)
            ->middleware(['can:agency index'])
            ->name('index');

        Route::get('edit', AgencyEditFrontend::class)
            ->middleware(['can:agency edit'])
	    ->name('edit');

        ...
    });

});

livewire :

class DashboardFrontend extends Component
{
    public function goTo(Agencies $agency)
    {
        if (! Auth::user()->hasRole('root') ) {
            session(['agency_id' => $agency->id]);
        }

        return redirect()->route('panels.agency.index', [ $agency->hashid() ]);
    }
}

Because I have a system where one account can have more than 1 agency.
When choosing an agency on dashboard page, it will set session for agency_id.

[erikn69]

After change the agency_id on dashboard try setPermissionId again, also remove the relation Role and Permission on Auth::user() for the redirect

class DashboardFrontend extends Component
{
    public function goTo(Agencies $agency)
    {
        if (! Auth::user()->hasRole('root') ) {
            session(['agency_id' => $agency->id]);
            setPermissionsTeamId( $agency->id );
            Auth::user()->unsetRelation('permissions')->unsetRelation('roles');
        }

        return redirect()->route('panels.agency.index', [ $agency->hashid() ]);
    }
}

Also try middleware priority #1906 (reply in thread)

Also for "remember me" functionality laravel/framework#42316

[gzai]

I forgot to add middleware in $middlewareGroups web

kernel

protected $middlewareGroups = [
    'web' => [
        ...
        \App\Http\Middleware\AgencyPermission::class,
    ],
];

protected $routeMiddleware = [
    ...
    'agency_permission' => \App\Http\Middleware\AgencyPermission::class,
]

and I will adjust my code for "remember me".

Thanks @erikn69