Laravel Oauth2 Scopes and Routes

Question

I'm working on a Laravel API with Oauth2 (lucadegasperi/oauth2-server-laravel) that uses different scopes, lets say admin and user. The API serves an emberjs application on the frontend. Obviously the user will have access to less resources than the admin. My problem is that, ember will make requests to certain routes that should have the same name but that will use different controllers.

I would like to setup my api so that I could use a route of the same name, using different controllers in both scopes so I can separate things a bit. Because I would like to leave the ember app structure mostly as it is.

The problem is when I make a request as admin it throws a 403 saying that only user scope can use that route.

That wasn't what I thought would happen. I thought the filter would first check the scope and enter the route even if the same route exists in another scope. But from the looks of it, you have to either use different route names which would be bad for my Ember App or you filter what is sent to each role from each controller and methods and use the route filter "oauthOr" so both roles can access the controller.

In case there's no way to do what I'm trying (see code), is there a way to prevent the controller from executing certain methods based on user role/scope? Appart from manually "ifing and elseing" all over the place?

Below is an example that illustrates what I'm trying to accomplish.

    Route::group(array( 'prefix' => 'api/1', 'before' => 'oauth:admin' ), function(){

    Route::resource('cars', 'ApiAdminCarsController');
    Route::resource('bikes', 'ApiAdminBikesController');

});

Route::group(array( 'prefix' => 'api/1', 'before' => 'oauth:user' ), function(){

    Route::resource('cars', 'ApiUserCarsController');
    Route::resource('bikes', 'ApiUserBikesController');

});

We're still using 4.2 which was the latest when we last touched the api. — bzlies
It's too late here for my brain to formulate a proper answer, but I recommend using Route::before() combined with return Redirect::action() to do what you want. It's going to have some if/else's though. If you were in Laravel 5, this would be a perfect job for middleware. You can't register two routes with the same path, as you've found. — Ben Claar
Thanks for responding, it's late here too lol. I took a look at Middleware and that would be exactly what I want, so I will have a talk with the team about updating Laravel, our backend guy already uses it. — bzlies
Honestly the logic will be identical whether you put it in Middleware or Route filters. But keep in mind Laravel 5.2 won't have Route filters. — Ben Claar

rickshawhobo rickshawhobo · Accepted Answer · 2016-02-01T15:45:57

In the Route::resource call you can do certain things like "only", "except" to limit which methods can be executed by which route.

Laravel Oauth2 Scopes and Routes

1 Answers