Best way to check global admin user permission when the team feature is enabled

[hl2000]

Thanks for all your efforts to provide this comprehensive library!

I understand that after you have enabled the team feature, the team_id is always required whenever you need to check a permission or a role, if you don't set a team_id by using setPermissionsTeamId(current_team_id), then you will have no access to anything.

I have some teams, each team has its own team leader and members. A user may be a team leader for one team and also be a member of another team.

I have a manager role who is managing all the teams. Based on the suggestion of creating a superuser (https://spatie.be/docs/laravel-permission/v5/basic-usage/teams-permissions), I have created a global role (team id is NULL) called "manager", and when there is a new team being created, I will assign a "manager" role along with the new team id to this manager user. So the manager user will have access to this new team, and he has the "manager" role in this new team.

If the above settings are correct and it's the expected settings, then I have a question.

In my design, there is a dashboard that shows some figures like how many members for each team, who are the members and who is the team leader.

So when viewing this dashboard page, what permission should I check for?

This dashboard is showing figures of all teams, not any individual team, but seems there is no "global role" without team_id.
As mentioned in the document "when checking any role or permission, the team_id is always required". (https://spatie.be/docs/laravel-permission/v5/basic-usage/teams-permissions)

So I believe I should randomly pick an existing team_id and check for the manager role. That's because the manager user is supposed to have a manager role for every team.

Do you think this is the best way to do it? or do you have a simple and better solution? or better design to handle a global admin user permission to manage everything (so on top of the individual team).

Thank you guys!

[erikn69]

If i understood

like how many members are in each team, who are the members, and who is the team leader.

#1935 Makes a relation on team, and add withCount(['roles as users_count'=>fn($q)=>your_custom_logic_with_distinct]) and use with for get members, team leader, etc

#1948 Maybe informative

[hl2000]

thank you @erikn69

I think #1948 is quite useful for me!

As this PR is not merged to the master, I am planning to add those "scopeUser" functions into my own Permission class which extends the "\Spatie\Permission\Models\Permission", do you think that would be the correct way to have this "scopeUser" feature that you created?

Another question,
I checked this page and found some useful functions https://spatie.be/docs/laravel-permission/v5/basic-usage/basic-usage, but how do I list all permissions and/or roles for a user for all teams this user has access? For example, supply a user id, then a function returns all roles and permissions grouped by team id? Should I just simply loop all teams and use functions mentioned in #1948 ?

Thank you so much!

[erikn69]

do you think that would be the correct way to have this

Yes, authors are not acepting my PRs

Should I just simply loop all teams and use functions mentioned in #1948

No the best

If i understood, you should make a relation with teams on user model and get all using nested with example User:with('teams.roles','teams.permisssions')->find(YOUR_USER_ID), or make new custom relations on user model where avoid team_id like with('roles_all','permission_all'), but the first way make everything sorted with 2 levels, that looks better to me

[hl2000]

thanks!

I think if I want to use "User::with('teams.roles')->find(USER_ID)", I can't just use the existing "model_has_roles" table, probably I have to create a team_user table, right?

I am trying to just use the "model_has_roles" to retrieve all teams this user has access to.

this is my "model_has_roles" table

role_id	model_type	model_id	team_id
2	App\Models\User	5	3
2	App\Models\User	6	3
3	App\Models\User	6	4

I have added this function to my User model.

public function teams()
{
    return $this->belongsToMany('App\Models\Team', 'model_has_roles', 'model_id', 'team_id')->wherePivot('model_type', 'App\Models\User')->withPivot('role_id');
}

so now, if I call
User::find(USER_ID)->teams;
I will see all teams this user has access to and also the role_id for each team.
(If the user has more than one role for the same team, all records will be returned).

From my testing, seems ok. Do you think this method would be fine? Shouldn't create another problem, right?

Regards,

[erikn69]

There is many ways, I don't see any problemas with that way