$owner = new Role();

$owner->name = 'owner';

$owner->display_name = 'Project Owner';

$owner->description = 'User is the owner of a given project';

$owner->save();

$admin = new Role();

$admin->name = 'admin';

$admin->display_name = 'User Administrator';

$admin->description = 'User is allowed to manage and edit other users';

$admin->save();

$user = User::where('username', '=', 'michele')->first();

//调用EntrustUserTrait提供的attachRole方法

$user->attachRole($admin); // 参数可以是Role对象，数组或id

// 或者也可以使用Eloquent原生的方法

$user->roles()->attach($admin->id); //只需传递id即可

$createPost = new Permission();

$createPost->name = 'create-post';

$createPost->display_name = 'Create Posts';

$createPost->description = 'create new blog posts';

$createPost->save();

$editUser = new Permission();

$editUser->name = 'edit-user';

$editUser->display_name = 'Edit Users';

$editUser->description = 'edit existing users';

$editUser->save();

$owner->attachPermission($createPost);

//等价于 $owner->perms()->sync(array($createPost->id));

$admin->attachPermissions(array($createPost, $editUser));

//等价于 $admin->perms()->sync(array($createPost->id, $editUser->id));

$user->hasRole('owner'); // false

$user->hasRole('admin'); // true

$user->can('edit-user'); // true

$user->can('create-post'); // true

$user->hasRole(['owner', 'admin']); // true

$user->can(['edit-user', 'create-post']); // true

$user->hasRole(['owner', 'admin']); // true

$user->hasRole(['owner', 'admin'], true); // false

$user->can(['edit-user', 'create-post']); // true

$user->can(['edit-user', 'create-post'], true); // false

Entrust::hasRole('role-name');

Entrust::can('permission-name');

// match any admin permission

$user->can("admin.*"); // true

// match any permission about users

$user->can("*_users"); // true

$user->ability(array('admin', 'owner'), array('create-post', 'edit-user'));

// 或者

$user->ability('admin,owner', 'create-post,edit-user');

$options = array(

    'validate_all' => true | false (Default: false),

    'return_type' => boolean | array | both (Default: boolean)

);

$options = array(

    'validate_all' => true,

    'return_type' => 'both'

);

list($validate, $allValidations) = $user->ability(

    array('admin', 'owner'),

    array('create-post', 'edit-user'),

    $options

);

var_dump($validate);

// bool(false)

var_dump($allValidations);

// array(4) {

//     ['role'] => bool(true)

//     ['role_2'] => bool(false)

//     ['create-post'] => bool(true)

//     ['edit-user'] => bool(false)

// }

Entrust::ability('admin,owner', 'create-post,edit-user');

// 等价于

Auth::user()->ability('admin,owner', 'create-post,edit-user');

@role('admin')

    <p>This is visible to users with the admin role. Gets translated to

    \Entrust::role('admin')</p>

@endrole

@permission('manage-admins')

    <p>This is visible to users with the given permissions. Gets translated to

    \Entrust::can('manage-admins'). The @can directive is already taken by core

    laravel authorization package, hence the @permission directive instead.</p>

@endpermission

@ability('admin,owner', 'create-post,edit-user')

    <p>This is visible to users with the given abilities. Gets translated to

    \Entrust::ability('admin,owner', 'create-post,edit-user')</p>

@endability

Route::group(['prefix' => 'admin', 'middleware' => ['role:admin']], function() {

    Route::get('/', 'AdminController@welcome');

    Route::get('/manage', [

        'middleware' => ['permission:manage-admins'], 

        'uses' => 'AdminController@manageAdmins'

    ]);

});

'middleware' => ['role:admin|root']

'middleware' => ['permission:owner', 'permission:writer']

'middleware' => ['ability:admin|owner,create-post|edit-user,true']

// 只有拥有'create-post'权限对应角色的用户才能访问admin/post*

Entrust::routeNeedsPermission('admin/post*', 'create-post');

// 只有所有者才能访问admin/advanced*

Entrust::routeNeedsRole('admin/advanced*', 'owner');

// 第二个参数可以是数组，这样用户必须满足所有条件才能访问对应路由

Entrust::routeNeedsPermission('admin/post*', array('create-post', 'edit-comment'));

Entrust::routeNeedsRole('admin/advanced*', array('owner','writer'));

Entrust::routeNeedsRole('admin/advanced*', 'owner', Redirect::to('/home'));

// 如果用户拥有'create-post'、'edit-comment'其中之一或者两个权限都具备则可以访问

Entrust::routeNeedsPermission('admin/post*', array('create-post', 'edit-comment'), null, false);

// 如果用户是所有者、作者或者都具备则可以访问

Entrust::routeNeedsRole('admin/advanced*', array('owner','writer'), null, false);

Entrust::routeNeedsRoleOrPermission(

    'admin/advanced*',

    array('owner', 'writer'),

    array('create-post', 'edit-comment'),

    null,

    false

);

Route::filter('manage_posts', function()

{

    // check the current user

    if (!Entrust::can('create-post')) {

        return Redirect::to('admin');

    }

});

// 只有用户对应角色拥有 'manage_posts' 权限才能访问任意 admin/post 路由

Route::when('admin/post*', 'manage_posts');

Route::filter('owner_role', function()

{

    // check the current user

    if (!Entrust::hasRole('Owner')) {

        App::abort(403);

    }

});

// 只有所有者才能访问 admin/advanced* 路由

Route::when('admin/advanced*', 'owner_role');