Users inheriting permissions from a relationship

[BrekiTomasson]

So we've got a fairly standard SAAS app with the usual roles; public, premium, admin, and god, each with their own sets of permissions, and everything is working fine. Now, in the foreseeable future, we'll be adding a corporate tier to our membership, where individual users can belong to a corporation (and have the new corporate role). Instead of each individual user having their own subscription, the subscription would be connected to the corporation, and the user assigned as administrator for that corporation will be able to add/remove users up to the limit as defined by their subscription tier. So far, no problem, fairly straight forward.

The issue comes when we want to apply different sets of permissions to each corporation. Now; the easy way to do this would, of course, be to have a different role for each corporation, but that's ugly, as we already have a corporations table in the database that contains all the data related to the corporation, including the relationship to the users, the Billable trait from Cashier, etc. What we'd like to do is to just use HasRoles in the Corporation model, assign the new corporate role to each corporation and assign any additional/specific permissions to the corporation as needed.

The issue, as I'm sure you've gathered by now, is that if I ask if ($user->can('receive sms notifications'), it only checks the user, not if the corporations that the user belongs to have this permission. Ideally, I would want all of the various permission checks to query the user's corporate relationships (if any) to check if the user has that permission as well. In a perfect world, even $user->getPermissionNames() should return permissions inherited from the corporation(s) that the user belongs to, but I would be happy if I just got $user->can() to work.

I'm assuming that this is something that could be done through Gate::before(), basically iterating through $user->corporations, if any, returning true if one or more of the user's corporations has that permission, otherwise null. Would this have any unintended side-effects? What scenarios and/or kinds of queries would this solution not work for? I'm assuming things like $user->getAllPermissions() and stuff like that wouldn't reflect things inherited by the corporation - which is okay, even though I'd love it if it did...

Any thoughts, comments, ideas or previous work I could look at for inspiration? Any suggestions would be much appreciated before I start spending hours running down the wrong rabbit hole! Thanks!

[drbyte]

The can() functionality is indeed provided via Gate::before() in the PermissionRegistrar.
However, you might be able to avoid having to touch that by simply overriding the hasPermissionViaRole() trait in your user model with your own implementation which adds a check against your corporation's roles.

[BrekiTomasson]

Ooh, that's a clever way of doing it, thanks for the suggestion!