Advanced laravel permissions

[guev4ra]

I'm making company management system, and now it's time to wrap up the roles.

So, therefore, my app is structured in the following way:

Company has many divisions.
Division has many sub-divisions.
Sub-division has many employees.

What I'm wondering is how do set up roles and permissions in smoothest manner, considering few requirements:

Super-admin - can do whatever he likes.
Manager - can manage ONLY one (his) division and all of the sub-divisions and employees that belongs to his division.
Coordinator - can manage one or more divisions with each sub-division that belongs to these divisions and all of the employees.
Group leader - can manage one or more subdivisions from all over the place.

One way that I'm thinking is to add few extra columns to user model, something like: division_id, subdivision_id, is_super_admin, but that fails given the fact that one user can have permissions for more than one division, subdivision etc.

Building permission for each and every division/subdivision isn't good, as there should be a lot of divisions/subdivisions.

How do I even get started with this, as I'm stuck for quite some time now.

Thanks in advance!

There are related issues, but none of them seems to do me any good.
#1187
#1186
#1135

[erikn69]

Maybe #1804
Your team is sub division

[guev4ra]

That might work to some extent. Is there a way to add multiple teams, so team_id in this case should be division_id, but "subteam_id" should be subdivision_id or is there a written workaround that I could reference to, since I could not find something similar here?
And, of course, this goes without saying - thank you!

[erikn69]

You can overwrite almost everything on User,Role,Permission models, you could make your custom validation, custon relationships and others
For example you could add custom checks on User model overwriting checkPermissionTo before hasPermissionTo

laravel-permission/src/Traits/HasPermissions.php

Lines 202 to 209 in fc841f8

	public function checkPermissionTo($permission, $guardName = null): bool
	{
	try {
	return $this->hasPermissionTo($permission, $guardName);
	} catch (PermissionDoesNotExist $e) {
	return false;
	}
	}

Also you can use different models for Manager,Coordinator,Group Leader and use a custom team_id for each one, or use a morph relation on teams