{"id":277,"date":"2023-01-21T20:13:52","date_gmt":"2023-01-21T17:13:52","guid":{"rendered":"https:\/\/akaunting.com\/hc\/?post_type=docs&#038;p=277"},"modified":"2023-02-01T19:44:05","modified_gmt":"2023-02-01T16:44:05","slug":"permissions","status":"publish","type":"docs","link":"https:\/\/akaunting.com\/hc\/docs\/developers\/permissions\/","title":{"rendered":"Permissions"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Akaunting provides a powerful ACL system thanks to the wonderful&nbsp;<a href=\"https:\/\/github.com\/santigarcor\/laratrust\" target=\"_blank\" rel=\"noreferrer noopener\">Laratrust<\/a>&nbsp;package for Laravel. It ships with very useful functions on both PHP and Blade templates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Akaunting adds even more power to Laratrust with an easy-to-use interface to manage all Users, Roles, and Permissions.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/akaunting.com\/hc\/wp-content\/uploads\/2023\/02\/users-1024x576.gif\" alt=\"\" class=\"wp-image-336\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Furthermore, all these permissions and roles are also applicable to RESTful API access so you can create an API user account that can just read but not write data to your Akaunting.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Assigning permissions to controller<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of setting the permission middleware&nbsp;<a rel=\"noreferrer noopener\" href=\"https:\/\/github.com\/akaunting\/akaunting\/blob\/master\/app\/Http\/Controllers\/Modals\/Accounts.php#L16\" target=\"_blank\">manually<\/a>&nbsp;to controller functions, Akaunting tries to&nbsp;<a rel=\"noreferrer noopener\" href=\"https:\/\/github.com\/akaunting\/akaunting\/blob\/master\/app\/Traits\/Permissions.php#L467\" target=\"_blank\">convert<\/a>&nbsp;your controller to Laratrust format automatically.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In any case, make sure you first create and attach the permissions of controllers into the&nbsp;<code>FinishInstallation<\/code>&nbsp;listener by just using the following snippet:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"php\" class=\"language-php\">\/\/ c=create, r=read, u=update, d=delete\n$this-&gt;attachPermissionsToAdminRoles([\n    $this-&gt;alias . '-posts' =&gt; 'c,r,u,d',\n    $this-&gt;alias . '-comments' =&gt; 'r',\n]);<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><a rel=\"noreferrer noopener\" href=\"https:\/\/github.com\/akaunting\/module-my-blog\/blob\/master\/Listeners\/FinishInstallation.php#L32\" target=\"_blank\">Here<\/a>&nbsp;you can see the example of the&nbsp;<code>My Blog<\/code>&nbsp;module.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Checking for permissions<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It\u2019s so simple to check for permissions:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"php\" class=\"language-php\">user()-&gt;can('update-my-blog-posts');\nuser()-&gt;canAny(['create-my-blog-posts', 'update-my-blog-posts']);<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"php\" class=\"language-php\">@can('update-my-blog-posts')\n    &lt;p&gt;This is visible to users with the given permissions.&lt;\/p&gt;\n@endcan<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You should always check for permission instead of role because users can create custom roles. Feel free to read Laratrust documentation about advanced permission&nbsp;<a rel=\"noreferrer noopener\" href=\"https:\/\/laratrust.santigarcor.me\/docs\/6.x\/usage\/roles-and-permissions.html\" target=\"_blank\">checks<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Akaunting provides a powerful ACL system thanks to the wonderful&nbsp;Laratrust&nbsp;package for Laravel. It ships with very useful functions on both PHP and Blade templates. Akaunting adds even more power to Laratrust with an easy-to-use interface to manage all Users, Roles, and Permissions. Furthermore, all these permissions and roles are also applicable to RESTful API access [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":31,"menu_order":6,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-277","docs","type-docs","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/akaunting.com\/hc\/wp-json\/wp\/v2\/docs\/277","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/akaunting.com\/hc\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/akaunting.com\/hc\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/akaunting.com\/hc\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/akaunting.com\/hc\/wp-json\/wp\/v2\/comments?post=277"}],"version-history":[{"count":2,"href":"https:\/\/akaunting.com\/hc\/wp-json\/wp\/v2\/docs\/277\/revisions"}],"predecessor-version":[{"id":343,"href":"https:\/\/akaunting.com\/hc\/wp-json\/wp\/v2\/docs\/277\/revisions\/343"}],"up":[{"embeddable":true,"href":"https:\/\/akaunting.com\/hc\/wp-json\/wp\/v2\/docs\/31"}],"wp:attachment":[{"href":"https:\/\/akaunting.com\/hc\/wp-json\/wp\/v2\/media?parent=277"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/akaunting.com\/hc\/wp-json\/wp\/v2\/doc_tag?post=277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}