Auth: Memasang Middleware | PART IV

 Pengantar

Memasang Middleware

Perintah

php artisan make:middleware AdminMiddleware

    Buka file yang baru dibuat di app/Http/Middleware/AdminMiddleware.php, lalu ubah isinya menjadi seperti ini:

<?php

namespace App\Http\Middleware;

use Closure;

use Illuminate\Http\Request;

use Symfony\Component\HttpFoundation\Response;

class AdminMiddleware

{

    /**

     * Handle an incoming request.

     *

     * @param  Closure(Request): (Response)  $next

     */

    public function handle(Request $request, Closure $next): Response

    {

        // Pastikan user sudah login dan kolom role-nya bernilai 'admin'

        if (auth()->check() && auth()->user()->role === 'admin') {

            return $next($request);

        }

        // Jika bukan admin, tolak akses dan tampilkan halaman 403

        abort(403, 'Akses ditolak. Halaman ini khusus untuk Administrator.');

    }

}

    

Daftarkan Middleware di bootstrap/app.php

<?php

use Illuminate\Foundation\Application;

use Illuminate\Foundation\Configuration\Exceptions;

use Illuminate\Foundation\Configuration\Middleware;

use App\Http\Middleware\AdminMiddleware;

use Illuminate\Http\Request;

return Application::configure(basePath: dirname(__DIR__))

    ->withRouting(

        web: __DIR__ . '/../routes/web.php',

        commands: __DIR__ . '/../routes/console.php',

        health: '/up',

    )

    ->withMiddleware(function (Middleware $middleware): void {

        // Daftarkan alias middleware admin di sini

        $middleware->alias([

            'admin' => AdminMiddleware::class,

        ]);

    })

    ->withExceptions(function (Exceptions $exceptions): void {

        $exceptions->shouldRenderJsonWhen(

            fn(Request $request) => $request->is('api/*'),

        );

    })->create();

 

Perbaiki route

Route::middleware('auth')->group(function () {

    Route::get('/profile', [ProfileController::class, 'edit'])->name('profile.edit');

    Route::patch('/profile', [ProfileController::class, 'update'])->name('profile.update');

    Route::delete('/profile', [ProfileController::class, 'destroy'])->name('profile.destroy');

    Route::get('/data', function () {

        return view('data');

    })->name('data');

});

// Rute KHUSUS ADMIN (User biasa tidak akan bisa masuk)

Route::middleware(['auth', 'admin'])->group(function () {

    Route::get('/database/users', function () {

        return view('data_user');

    })->name('database.users');

    Route::get('/database/riwayat', function () {

        return view('database.riwayat');

    })->name('database.riwayat');

});