FEATURE #1387: divide routes into groups - one for admin, the rest for other users

app/Http/Kernel.php

@@ -46,6 +46,7 @@ class Kernel extends HttpKernel
      */
     protected $routeMiddleware = [
         'auth' => \App\Http\Middleware\Authenticate::class,
+        'onlyAdmin' => \App\Http\Middleware\RequireAdminRole::class,
 //        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
         'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
         'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,

app/Http/Middleware/RequireAdminRole.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\User;
+use Closure;
+
+class RequireAdminRole
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request $request
+     * @param  \Closure                 $next
+     *
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        if (\Auth::user()->role != User::ROLE_ADMIN) {
+            return redirect()
+                ->back()
+                ->with('error', trans('auth.accessDenied'));
+        }
+
+        return $next($request);
+    }
+}

app/Http/routes.php

@@ -28,33 +28,21 @@ Route::group([
                  'prefix'     => 'admin'
              ], function () {
 
-    // display dashboard with some usefull information
-    Route::get('/', 'Dashboard@getIndex')
-         ->name('admin.dashboard');
-
+    // these routes are available only for user with role admin
+    Route::group(['middleware' => 'onlyAdmin'], function () {
         // display form for creating new user
         Route::get('users/new', 'CreateNewUser@getNewUser')
              ->name('users.new');
 
+        // POST methods
+        // display form for creating new user
+        Route::post('users/new', 'CreateNewUser@postRegistration')
+             ->name('users.newPost');
+
         // display form for edit of existing user
         Route::get('users/edit/{id}', 'EditUser@getEditExistingUser')
              ->name('users.edit');
 
-    // display user detail in admin
-    Route::get('users/detail/{id?}', 'UserDetail@getDetail')
-         ->name('users.detail');
-
-    // display list of all users registered into our system
-    Route::get('users/overview/{state?}/{perPage?}', 'UsersOverview@getOverview')
-         ->name('users.overview');
-
-    // custom fields
-    // ------------------------------
-
-    // list of all custom fields
-    Route::get('customfields/overview', 'CustomFieldsOverview@getOverview')
-         ->name('customfields.overview');
-
         // form for adding new custom field
         Route::get('customfields/new', 'CreateNewCustomField@getNew')
              ->name('customfields.new');
@@ -73,6 +61,32 @@ Route::group([
 
         Route::get('customfields/delete/{id}', 'EditCustomField@deleteCustomField')
              ->name('customfields.delete');
+    });
+
+    // these routes are available for all logged (authenticated) users
+
+    // display dashboard with some usefull information
+    Route::get('/', 'Dashboard@getIndex')
+         ->name('admin.dashboard');
+
+    // display user detail in admin
+    Route::get('users/detail/{id?}', 'UserDetail@getDetail')
+         ->name('users.detail');
+
+    // method for saving edited data of user
+    Route::post('users/edit/{id}', 'EditUser@postEdit')
+         ->name('users.editPost');
+
+    // display list of all users registered into our system
+    Route::get('users/overview/{state?}/{perPage?}', 'UsersOverview@getOverview')
+         ->name('users.overview');
+
+    // custom fields
+    // ------------------------------
+
+    // list of all custom fields
+    Route::get('customfields/overview', 'CustomFieldsOverview@getOverview')
+         ->name('customfields.overview');
 
     // logout method
     Route::get('logout', function () {
@@ -84,14 +98,6 @@ Route::group([
         return redirect()
             ->route('login')
             ->with('success', trans('admin/common.logoutSuccessfull'));
-    })->name('logout');
-
-    // POST methods
-    // display form for creating new user
-    Route::post('users/new', 'CreateNewUser@postRegistration')
-         ->name('users.newPost');
-
-    // method for saving edited data of user
-    Route::post('users/edit/{id}', 'EditUser@postEdit')
-         ->name('users.editPost');
+    })
+         ->name('logout');
 });

resources/lang/en/auth.php

@@ -15,5 +15,6 @@ return [
 
     'failed' => 'These credentials do not match our records.',
     'throttle' => 'Too many login attempts. Please try again in :seconds seconds.',
+    'accessDenied' => 'You cannot access this resource'
 
 ];