As I've mentioned before, now that we have groups, we can check if a User is in a given group and then grant permission that way. But, while that's possible, I think it just makes much more sense to distill everything down to individual permissions. Just because, well, that's how permissions are implemented. So, the first thing I want to do is take our loadRoles middleware. Because we don't have roles now, we have permissions, I want to rename this. So, let's do that as loadPermissionsMiddleware. And we're going to leave this alone for right now. Because I want to take a slightly different approach to how we check if a User is assigned a different permission. Now, because when it came to roles, our roles implementation, at least as far as checking them was, well, it could have been better. It seemed like there was a lot of complexity, both inside of the hasRole and the hasAnyRole.

Now, because when it came to roles, our roles implementation, at least as far as checking them was, well, it could have been better. It seemed like there was a lot of complexity, both inside of the hasRole and the hasAnyRole. And, instead, I think we could just simplify this. So that, for the hasPermission method, we could do something like this. To where we would have a method called getAllPermissions. And then this would return a collection. So that all we would have to do is check if it contains the lowercase version of the provided permission. And then that would be it. That way, this getAllPermissions method would be responsible for checking if the User is signed in. And if we are currently working with that currently logged in User.

That way, this getAllPermissions method would be responsible for checking if the user is signed in. And if we are currently working with that currently logged in user. And also fetching data from the context. Otherwise, it would build the collection of all of the other permissions. So let's go ahead and define that. We won't implement it just yet because down here it has any permission. Well, we can make this better as well. We will, of course, need to take the provided permissions and convert them into lowercase. So we could do what we have done before with array_map calling stringToLower on those permissions. But then we would call our getAllPermissions method, which returns a collection.

So we could do what we have done before with array_map calling strtolower on those permissions. But then we would call our getAllPermissions method, which returns a collection. So that we could check if it intersects with the provided permissions. And if it does, then we will check if it's not empty. In which case, the User would be allowed to do whatever the permission allows them to do. And that would be it. This is so much easier to understand. And I like that. So our getAllPermissions is first of all going to check if the currently signed in User is the same user that we are working with. Because if so, we need to check if the context has the hidden key of permissions.

So our getAllPermissions is first of all going to check if the currently signed in User is the same user that we are working with. Because if so, we need to check if the context has the hidden key of permissions. If it does, then we will simply retrieve our permissions from the context. And that's going to be it. We will store the collection inside of the context. Otherwise, we need to build our collection of permissions. In which case, we will first of all need to get all of the permissions from our groups. So we will get the groups for this User with the permissions. And then we will get those. But we want to extract the permissions itself.

And then we will get those. But we want to extract the permissions itself. And then we want to flatten that so that we can pluck out the auth code. Because that's how we determine our permissions. So we are going to get the auth code of the permissions from the groups of the User. But that's not everything. Because we also need to get the permissions from the permissions column. So we will get that. But we will pass that to the collect function so that we are working with the collection. So that then we will return our group permissions.

But we will pass that to the collect function so that we are working with the collection. So that then we will return our group permissions. We want to merge that with our normal permissions. But we want only the unique values. But then we also need to convert everything to lowercase. So we will map. We will call strtolower, passing in the item. And yeah, that should work. So let's go back over this.

And yeah, that should work. So let's go back over this. If the User that is signed in is the same as the User that we are working with. And if we have the permissions in the context, return what we have from the context. Otherwise, we build our collection of permissions. We first of all get the group permissions. So that we get the groups with the permissions. We get those. We pluck the permissions. We flatten it.

We pluck the permissions. We flatten it. And then we pluck the auth code from the permissions. Then we get the permissions from the permissions column as a collection. So that then we can group the group permissions with the normal permissions. We want the unique values. And then we want to convert those to lowercase. So all of the complexity then is right here inside of this method. And really it's not complex at all. It's just a lot of steps.

And really it's not complex at all. It's just a lot of steps. But this way it's all hidden here. Which makes it easy to check if a User is allowed to do something with a single permission. Or with multiple permissions. And when it comes time to load that data into the context. That's going to be very easy as well. Because all we need to do is check if the User is authenticated. So that we can add the hidden permissions. And then all we need to do is call the getAllPermissions method.

So that we can add the hidden permissions. And then all we need to do is call the users getAllPermissions method. That's so much easier to write. It's a lot easier to understand I think as well. Now of course if we had actual tests that would be ideal. But we don't. So the next thing we will need to do is check everything. So it looks like we haven't broken anything. At least as far as the articles is concerned. We're still able to do anything.

At least as far as the articles is concerned. We're still able to do anything. And we are signed in as an admin. But we can easily check that by doing this. Inside of hasPermission we will simply return false. In which case all of our buttons should go away here. Because all of our checks for the articles used that hasPermission method. So we can see that even though we are still signed in as admin. We can't do anything. And that's perfect.

We can't do anything. And that's perfect. So that works. Now we need to test the hasAnyPermission. And this is going to be very evident just right out of the gate. Because there are so many things that rely upon this. So that whenever we refresh now. Yeah this is not authorized. So I really like this implementation. Of course this is the nature of software development.

So I really like this implementation. Of course this is the nature of software development. You know we very rarely write the final code at the very beginning. It's usually a gradual thing. We write the code that works. And then we massage it into something that's easier to read and maintain. And well that was kind of the case here. I really like how the getAllPermissions method has all of the complexity. So that when it comes time to check if a User has permissions. Or we need to load those permissions into the context.

So that when it comes time to check if a User has permissions. Or we need to load those permissions into the context. All we have to do is just call that single method. And we're done.