Laravel 8.x -当一个用户有多个角色时，根据角色过滤用户

php artisan make:middleware RoleMiddleware

namespace App\Http\Middleware;

use Closure;
use Illuminate\Support\Facades\Auth;

class RoleMiddleware
{
    public function handle($request, Closure $next, $role)
    {
        if (!Auth::user()->hasRole($role)) {
            abort(403, 'Unauthorized action.');
        }

        return $next($request);
    }
}

public function roles()
{
    return $this->belongsToMany(Role::class);
}

public function hasRole($role)
{
    return $this->roles->contains('name', $role);
}

protected $routeMiddleware = [
    // ...
    'role' => \App\Http\Middleware\RoleMiddleware::class,
];

Route::group(['middleware' => ['role:admin']], function () {
    // 只有角色为 admin 的用户可以访问这些路由
});

php artisan make:policy RolePolicy --model=User

namespace App\Policies;

use App\Models\User;
use Illuminate\Auth\Access\HandlesAuthorization;

class RolePolicy
{
    use HandlesAuthorization;

    public function manage(User $user, $role)
    {
        return $user->hasRole($role);
    }
}

protected $policies = [
    User::class => RolePolicy::class,
];

public function manage(User $user, $role)
{
    $this->authorize('manage', [$user, $role]);

    // 用户拥有指定角色的权限，可以执行操作
}