Latest / North Meets South Web Podcast / Laracon, controller middleware, and permissions

Transcript

Laracon, controller middleware, and permissions · North Meets South Web Podcast

• 0:00
  -Hey, this is Michael Dyrynda. -And this is Jake Bennett.
• 0:05
  And welcome to Episode 179 of the North Meet South Web Podcast.
• 0:11
  I thought it was 180. 179, huh?
• 0:14
  Yeah.
• 0:16
  -179, okay. Well, hey- -Next- next- next week, we'll get to 180.
• 0:19
  179 it is, folks. Um,
• 0:22
  it is post July 4th, and I'm still sort of hanging on to the mustache thing here-
• 0:27
  -It's fine -... a little bit.
• 0:28
  I can- I can... Look, the goatie, th-
• 0:31
  -the dirty goatie I can live with. -It- it's okay.
• 0:32
  The mustache...
• 0:34
  -I'm gonna shave it all off for- for- -Maybe, maybe
• 0:36
  ... Laracon again. And now you're just gonna have to live with, uh, Jake with the
• 0:39
  mustache.
• 0:40
  Um, no, I'm not actually not gonna do that. I'm gonna- I'm gonna- I'm gonna just
• 0:44
  put it all back to how it- how it should normally be. Um, but in other news-
• 0:48
  -I was just- -We- we are actually staying at the same
• 0:50
  hotel.
• 0:52
  -I'm pretty stoked. -Yes, finally.
• 0:54
  -Finally, yes. -That- that worked out well in the end.
• 0:56
  -It did end up working out well. -Worked out well in the end because
• 0:59
  I said back in February, like, "I've bo- bought my ticket, I've booked my
• 1:02
  -accommodation-" -Yep, yep.
• 1:03
  "... this is the closest hotel." And it ended up- ended up- ended up being one of
• 1:07
  -the- -Yeah, the conference, yeah
• 1:08
  ... the official, I guess, conference hotels.
• 1:11
  And so by the time you booked, three weeks before the event-
• 1:13
  Yeah.
• 1:15
  -You're like, "There's no rooms anywhere." -Yeah, you were like, oh-
• 1:17
  -I wonder why, you know? -Right, yeah. And so they ended up opening
• 1:20
  -up, and, uh, yep. -1,200 people-
• 1:22
  -So- -1,200 people coming in. Yeah, so that
• 1:24
  -worked out. -It's gonna be awesome. I'm so excited. We
• 1:28
  can do, like, pillow fights middle of the night, just like-
• 1:31
  -Pillow fights. -Yep.
• 1:31
  -Yeah, yep. -Just gonna find out whose room is it. We
• 1:33
  gotta have- have so many people there. Knock on the doors and just hit people
• 1:37
  -with pillows. It's gonna be good times. -It's gonna be a bit like that. It's, um...
• 1:40
  Yeah, I looked, 'cause I, um, I messaged Matt, Matt Stouffer, and I said, "What are
• 1:45
  we doing for coffee?" Because I know it's only three days, but I can't drink
• 1:49
  -Starbucks for three days. -Yep.
• 1:50
  -Like, that's not an option. -Yep, yep.
• 1:51
  I need good coffee. It turns out... Now, whether or not it is good is to be seen,
• 1:57
  but it turns out that in that hotel, in the Vib by Best Western, for those of you
• 2:02
  who are staying there, there is a coffee, there's, like, a cafe-
• 2:05
  -Nice. Okay, okay -... downstairs in the hotel.
• 2:08
  So it- it has, like, a four-and-a-half star rating, so I'm hoping-
• 2:13
  -Sweet -... that that's good enough.
• 2:15
  -That'll be good. -There is also, for those of you staying
• 2:17
  there, a taqueria downstairs. So tacos and coffee, we should be sorted.
• 2:21
  Sounds amazing. Yeah, I'm- I'm really excited. It looks like a really nice hotel
• 2:25
  -as well. Um, like you said- -Mm-hmm
• 2:27
  ... it's like, I think the closest hotel to the venue of the ones that there are
• 2:30
  -on- -Yeah
• 2:31
  -... that are on there. So, um- -Mm-hmm
• 2:32
  ... yeah, it's- it's gonna be amazing. I'm so excited. I cannot wait. I'm flying in
• 2:36
  Monday, leaving Thursday evening. So if any of you have no plans for Thursday,
• 2:42
  meaning you've stayed Wednesday, you did the afterparty on Wednesday, you slept in
• 2:46
  on Thursday, and now it's Thursday afternoon and you're looking for something
• 2:49
  to do, hit me up on Telegram. I'd love to hang out because Michael will probably be
• 2:53
  gone by then. Michael, will you be out by then?
• 2:56
  -Yeah. -Yeah, so I'll be leaving at 5:30-
• 2:57
  -Yeah, we- we get in at, like, 3:00 -... which means I'll have a bit of time
• 2:59
  -for lunch. -Yeah.
• 2:59
  I'll be able to... I'll be free for lunch if anybody wants to hang out.
• 3:03
  -Yeah, we get in at 3:00-ish on- -Monday, yep
• 3:06
  ... Monday, Aaron and I. And then, we were supposed to leave at 6:00 or something
• 3:10
  -like that, 6:00 PM on Thursday. -Yeah.
• 3:14
  But our flight got pulled back to 11:00 AM.
• 3:17
  -Ah. -So we're probably gonna be at the airport
• 3:18
  at, like, I don't know, 8:00, just to be safe.
• 3:20
  -Yeah. -Just who knows?
• 3:21
  Yeah, we can catch coffee. You and I can catch coffee.
• 3:22
  Although I saw recently... Yeah, yeah, we'll be all right. We'll- the- we'll have
• 3:26
  plenty of opportunities to- to see each other over the- the three days-
• 3:29
  -For sure -... that- that we're there, but
• 3:31
  yeah, I am... I saw- I saw on the news or something, there was an article the other
• 3:36
  day that, like, tourism is way down for Australians into
• 3:40
  -the US at the moment, like 12 or 15%- -Wow, that's crazy
• 3:43
  -... on what they were expecting normally. -Yeah.
• 3:46
  So I'm- I'm hoping that we have, like, a lo- although these- these flights that we
• 3:51
  bought were on sale, so they're sale dates, so I suspect that maybe they will
• 3:55
  be booked-booked. But it'd be nice to see if there's a bit of, uh,
• 3:59
  -bit of space on the plane actually. -Some extra legroom. Yeah, for sure.
• 4:03
  -Yeah. -I actually-
• 4:03
  -We'll see what happens -... there was a lady sitting in my seat on
• 4:05
  the last flight I was on.
• 4:07
  And I didn't bother her 'cause, like, it doesn't matter, there's extra seats. And
• 4:10
  so I told the attendant, I was like, "Do you mind if I sit in another seat?" And
• 4:13
  she's like, "Yeah, that's fine." I said, "Why- why don't I just go sit in first
• 4:15
  class, it's like it's enough, should I sit up there?" She was like, "It's fine with
• 4:18
  me." She's like, "But let me check." And so she checked and the lady up front was
• 4:21
  like, "No". I was like, "Come on", so I just took an exit seat. It was fine.
• 4:25
  -Ah, you tried. -I did try. She was almost, I mean, almost
• 4:27
  -had her. -You tried.
• 4:28
  -Yep. I was almost there. -Almost. Almost there. Almost got it. Yeah,
• 4:31
  we- we definitely for the long haul flights, the, uh, Sydney to Dallas and
• 4:36
  then the LA to Melbourne on the way back, we-
• 4:40
  -we went for exit seats. -Nice, there you go.
• 4:42
  -Aaron and I just- -Yeah, some extra room.
• 4:44
  Um, and hopefully these are good exit seats because the last time I was coming
• 4:48
  back from the US, I went
• 4:50
  thinking that it'd be good to sit in the, like, the- the bulkhead row-
• 4:54
  -Yeah -... behind the- the bathrooms.
• 4:56
  -Yeah. -Terrible idea. Don't ever do that. Because
• 4:58
  -number one, the armrests- -Oh, no.
• 5:00
  Like, the armrests are fixed, so you can't move them. So I had, like... I was
• 5:04
  uncomfortable the whole time. And you think because you're at the bulkhead,
• 5:08
  there's a bit more room, and there is physically a bit more room to stretch your
• 5:11
  legs out. But the problem is people walk past there to go-
• 5:14
  -Oh, God. -... to the bathroom from the bathroom. So
• 5:17
  yeah, no good. So we are on the... We're by the galley,
• 5:21
  um, on the exit- exit row this time, and to, like, the- the- the left of the plane.
• 5:26
  So hopefully that'll be a better seat. But I didn't... I looked at even premium
• 5:31
  c- premium economy was like $6,000 return or something like that.
• 5:34
  -My gosh. -I said, "Nah. Not."
• 5:35
  -Hey, okay, I've got one- -No thank you, not for me
• 5:37
  ... one quick tip for you here
• 5:39
  -for sleeping on planes. -Mm-hmm.
• 5:41
  Okay?
• 5:41
  There is this amazing product called the Sleeper Hold.
• 5:46
  -Sleeper Hold. Is- -Right.
• 5:48
  -No, seriously. It was invented by an- -Nonsense
• 5:51
  -... an MMA guy, a UFC fighter- -Mm-hmm
• 5:54
  ... who had to go on flights and trips and stuff like that all the time. And he was,
• 5:57
  like, sick of, like, not being able to sleep well on these- on these trips.
• 6:00
  -Mm-hmm. -So he invented this thing called the
• 6:02
  Sleeper Hold. Now, I got one at a conference. I was like, "What is this
• 6:04
  nonsense?"Oh, my gosh. I will never travel without it again. It is amazing, and you
• 6:11
  can actually sleep well on flights or on buses or on-
• 6:15
  -Right -... on anything like that- ... that has,
• 6:17
  like a rest... Like, a seat behind you.
• 6:19
  It is incredible. So if you... I mean, because you're gonna be on these insane
• 6:22
  flights, you know, you're gonna be hitting 14 and a half hour time difference jet
• 6:26
  lag thing,
• 6:27
  I would suggest snapping one of these up. Now, they're not inexpensive, but they are
• 6:31
  amazing, amazing. And so, um, check it out. Sleeper-
• 6:35
  Oh, the travel pillow. Right, right, right, right.
• 6:36
  Sleeper Hold. Yeah, yeah. It's a s- it's a no-
• 6:37
  -When you say sleeper hold- -And I know, and I know, it's- it's not,
• 6:40
  -you know, it's not just a travel pillow. -Yeah.
• 6:42
  -It's- it's- it's a little bit different. -Yeah, yeah, yeah.
• 6:44
  They've got some really good marketing as well, but I've actually used it and the
• 6:47
  marketing holds up. The hype holds up. It's really good. So for any of you
• 6:50
  listening who are gonna be going to Laracon, grab a Sleeper Hold. Tell them
• 6:53
  Jake sent you, there's no referral code or anything. Sorry, otherwise I would give
• 6:57
  it to you. But, uh, they're pretty sweet. Pretty sweet. So...
• 7:00
  Right. So this thing, you strap to the... You strap to the seat, and it kind of
• 7:04
  holds your head so your face doesn't flop forward.
• 7:05
  That's right. Yeah, so you have a little neck thing that-
• 7:07
  -Yeah, cool -... goes behind, just behind the- the,
• 7:09
  like, the little dip in your neck, in the back of your neck. You just put the pillow
• 7:12
  -there- -Mm-hmm
• 7:12
  ... and then there is a strap that goes around the back of the seat. And then
• 7:15
  there's like a eye mask that kind of goes over the front of your eyes and holds your
• 7:19
  head in place up against the back of the seat. And you don't, you know-
• 7:23
  -Yeah, right -... those neck cushions, they don't
• 7:24
  actually hold your head up, so you- you kind of, you have to try-
• 7:27
  -Yeah, yeah, yeah -... lean your head back. It doesn't work
• 7:28
  very well. This works amazingly, and I have slept like a baby on flights with
• 7:32
  -this thing. So, highly suggest it. -I'm, uh... I have sent this to my wife.
• 7:36
  -Mm-hmm. -I am very fortunate in that I, generally
• 7:41
  speaking, on a flight, will close my eyes and wake up eight or nine hours later.
• 7:46
  -That's amazing. -Especially on the way back. Especially on
• 7:49
  the way back, because it'll be, you know, three days of go, go, go. We've got the-
• 7:54
  the mostly technical party on Monday night.
• 7:57
  -Yep, Monday night. -We've got after dark on- on Tuesday night,
• 8:00
  then there's like... I assume we'll do something on-
• 8:03
  -Wednesday night, yeah. Did you- -... on Wednesday night as well, and then
• 8:04
  -we're gonna be up- -There's a link, I'll send it to you.
• 8:06
  -There's a Luma something. -Yeah, yeah, yeah. I-
• 8:10
  -You get that one? -Yes, that was for Tuesday night, I think,
• 8:11
  -that one. Yeah, I got that one s- -I think that was-
• 8:12
  -So, did that, um... -I thought that- I thought that was for
• 8:13
  Wednesday.
• 8:16
  Let me look.
• 8:17
  -Luma after party. -Can you double check?
• 8:19
  Yep, I'm looking right now. Tuesday. You're right, it is Tuesday. Yep.
• 8:23
  -Mm-hmm. -My bad.
• 8:23
  Yeah.
• 8:24
  Yeah, so, um, that, and then Wednesday night, I assume we'll do something. Go
• 8:29
  -grab dinner or something- -Yeah, yeah
• 8:30
  ... with the- with the guys. Anyone who's- who's keen for that.
• 8:33
  -For sure. -Um, and then Wednesday we'll be up early,
• 8:35
  and then we're just gonna have to try and power through LA. Um, Aaron and I are
• 8:40
  gonna go and do the unthinkable. And I don't know if we're actually gonna do
• 8:44
  this, but I- I joked to Aaron, I said, "So, outside of LAX, there's a Five Guys,
• 8:48
  -an In-N-Out, and a Chick-fil-A." -Gotta do it.
• 8:51
  And I'm like, "We'll just eat all of them. We'll just do all three."
• 8:53
  You gotta do it.
• 8:54
  And then, uh, yeah. So
• 8:57
  by the time I get on that plane, and- and this has happened every time I've left the
• 9:00
  US for- for any trip that I've been over there, I'm asleep before wheels up. Like,
• 9:06
  before we leave the ground- ... my eyes are shut. I'm out.
• 9:08
  Yeah.
• 9:09
  -Oh, my gosh. -And they come- they come at like an hour
• 9:11
  or- or- or two later, and they're like, "Do you want dinner?" I'm like, "It's
• 9:13
  midnight. I don't- I don't want dinner. Go away."
• 9:15
  -That's funny. -"Why did you wake me up for this?" So...
• 9:16
  -That's hilarious. -This light- this light keeps on flicking
• 9:20
  off and on for some reason, I don't know why. So every now and then I get shrouded
• 9:23
  in darkness.
• 9:24
  -Well- -So yeah, Laracon, uh, this-
• 9:25
  Anyway, long story short. Yeah, absolutely
• 9:26
  ... this will be our last- last North Meet South before Laracon. Uh, we've got...
• 9:32
  We'll do an episode of Laravel News next week. Mm-hmm.
• 9:35
  And then we'll be on location.
• 9:38
  Is it that quick? No. Oh, no. We will have one more North Meet South before Laracon.
• 9:43
  Okay. Okay.
• 9:43
  And then we'll be on location. Yep, yep, yep, yep, yep.
• 9:47
  So yeah. A- and then for Laravel News, you and I will be,
• 9:52
  uh, running around. You did a day one recap last year with-
• 9:54
  -Yes -... David Hemphill.
• 9:56
  -Yes. -Which made- made me feel very slighted,
• 9:59
  -uh, that you would- -I'm so sorry.
• 9:59
  ... you would do something like- like that .
• 10:01
  I think I mentioned you. I thought I mentioned you.
• 10:02
  -You did- you did mention me. -Okay.
• 10:03
  But, uh, you know, I will- I will- I'll be there this time, so you watch yourself.
• 10:07
  And so it will definitely be you and me. Yeah, Hemphill. Watch it, you're gonna
• 10:10
  -get- you're gonna get a- -So yeah, we'll do-
• 10:12
  -... shiv. -We'll do a recap day one and we'll do day
• 10:13
  two, 'cause there was no day two last year.
• 10:15
  -Right. -Um, and I think we're gonna go around and
• 10:17
  -do some like vox pops- -Absolutely
• 10:19
  ... and speak to people and- and talk to them as well for Laravel News, so that'll
• 10:23
  be a bit of fun. Something- something to do.
• 10:24
  -Should be a good time. -So if- if you are interested
• 10:27
  in doing that, keep an eye out for us. We'll- we'd love to talk to you about what
• 10:31
  you think. I saw Taylor's got like a two-hour
• 10:34
  -keynote at the end of day one. -Wow.
• 10:36
  So that'll be- that'll be a bit of fun. And looks like there's a lot of variety in
• 10:39
  the talks as well. If you've- if you've seen the schedule, there's some- there's
• 10:42
  some, um, you know, 30-minute talks, 20-minute talks. They're all over the
• 10:47
  place this year, which- which is good. I think- I think mixing things up like that
• 10:51
  is- is good for the audience as well. Um, getting a- a mix of lengths and types and-
• 10:57
  and all sorts. So
• 10:58
  -very excited to get back over there- -Yeah
• 11:00
  ... after, what, six years or whatever it's been.
• 11:02
  Yep. It's gonna be incredible to have you, dude. It's been too long. Too long since
• 11:05
  we've been able to hang out in- in, uh, the real, right? In 3D.
• 11:09
  -Mm-hmm. -So it'll be fun. It'll be lots of fun. Hey
• 11:12
  folks, we have a couple different topics that I would like to talk about today. The
• 11:17
  first one is this. Should you have
• 11:22
  a middleware call inside the constructor of a controller? Okay, so
• 11:28
  set it up for you.
• 11:30
  This is something that used to be supported and I do not think it's
• 11:32
  supported anymore in Laravel 12, which is this. Inside of a controller you can, in
• 11:36
  the constructor, say, "This middleware," and then specify a middleware. And what
• 11:41
  this will do is this will apply that middleware to anything that you're going
• 11:45
  to be accessing that controller
• 11:48
  through, right? Any route that references anything that points to that controller,
• 11:52
  you can have a middleware in the constructor of that controller. Okay. Are
• 11:56
  you ready?
• 11:57
  Think about it for a second. Make up your mind. Do you think you should put it there
• 12:01
  or not?
• 12:02
  And
• 12:03
  go. All right, what do you think, Michael?
• 12:06
  No. And you, you, you posted this the other day-
• 12:09
  -I did -... in Telegram, and I-
• 12:11
  I'm gonna grab a water while you formulate your response and, and tell me why I
• 12:15
  shouldn't do it, so then I can actually come back and tell you why I think you
• 12:18
  should. But go ahead.
• 12:19
  Yeah.
• 12:20
  I mean, Laravel 12, you said you can't do it, so that's, that's as good a reason as
• 12:24
  any to not do it. Um, I know
• 12:27
  there used to be some explicit reason to do it. Like, you... There was some part of
• 12:32
  the request lifecycle that wasn't available inside of
• 12:37
  your route definitions, which is why you, you maybe wouldn't have done it
• 12:40
  previously. Like, you wanted to dynamically apply a middleware or
• 12:43
  something like that inside of the controller constructor.
• 12:47
  The, the reason I don't
• 12:49
  like the idea of putting the middleware in the controller
• 12:53
  is kind of similar to why I don't like using, um,
• 12:57
  events too much. I don't particularly like using observers and, and global scopes,
• 13:02
  although those things are a little bit more
• 13:05
  -opaque now- -Yeah, for sure they are
• 13:06
  ... because we've got the attributes to say, like, observed by, scoped by, and all
• 13:10
  of that kind of stuff. But I feel like
• 13:14
  the routes file is the first place that I'm going to look in a new application to
• 13:18
  see everything that's happening across the application. Like, I know what
• 13:22
  functionality is available, I know where to reach it. It's a very quick and easy
• 13:26
  way. W- this is the same reason I don't like route definitions inside of
• 13:29
  controllers using attributes, which is a thing that has-
• 13:32
  -Fair enough -... like, come and gone in the past.
• 13:34
  Because if you want to s- I mean, you can always do a route list and see the route
• 13:38
  list that way, but I think opening up the routes file and just scrolling through it
• 13:42
  and seeing everything that's there is my preferred method for, for dealing with
• 13:47
  that kind of stuff.
• 13:48
  When you start putting things in- inside a constructor, it's, it becomes
• 13:54
  less visible.
• 13:55
  Um, it... Like, does it still appear in the route list if you d- define a
• 13:59
  -middleware there? -That's a good question. I honestly don't
• 14:01
  -know. -'Cause that would be my hesitation.
• 14:02
  -I'm not sure. -Yeah. 'Cause that would be, that would be
• 14:04
  -another hesitation of mine- -I kinda feel like it wouldn't
• 14:07
  -... is that you don't know. -I kinda feel like it would not. Yeah.
• 14:09
  Yeah.
• 14:11
  Um, so yeah, my, eh, I never, I never do. Um,
• 14:17
  all of my middlewares are defined inside of
• 14:21
  -the routes file. Yeah. -Fair enough. Now that being said, uh, I
• 14:26
  mean there are multiple other places where there are middlewares being placed onto
• 14:30
  things without your knowledge or just explicitly by the framework. So,
• 14:36
  you know, one of those places is in the
• 14:38
  bootstrap, uh, app.php file, where you're-
• 14:41
  -Mm-hmm -... setting up all your routes and all
• 14:43
  those things. And if you use a then, uh, portion of the section there when you're
• 14:48
  defining those different routes, then you can apply middlewares there and things
• 14:53
  like that. You know, you can set up a new stack essentially. You have web, you have
• 14:56
  API, you have console, which are all getting set up. You have up, which is also
• 15:00
  another one that ships by default with Laravel 11.
• 15:02
  But if you have a then, you know, you might do something like development
• 15:05
  routes. Like, if you're in development, you will, then you'd bind these
• 15:08
  development routes, and you could put, uh, prefixes or middlewares on it in there.
• 15:13
  Uh, there was previously in, you know, previous versions where you had a, a route
• 15:17
  service provider or something like that, or the HTTP kernel, you could do things in
• 15:22
  -there as well when you'd register those- -Mm-hmm
• 15:23
  ... or when you'd bind those sorts of things. And so, it's not like it's only
• 15:27
  ever been that the routes file is the only place where middlewares are applied. I
• 15:32
  -mean, there's a web- -Right.
• 15:33
  There's a web stack that's applied by default.
• 15:35
  -Yeah, yeah. -So
• 15:36
  I get the argument that, like, if you can just go see the web.php, you can see
• 15:40
  everything on there, but it's not actually true. Like, there's... That's all the
• 15:43
  -things- -Mm-hmm
• 15:44
  ... that you would put on there, but it's definitely not all-
• 15:46
  -Yeah -... the things that are on there.
• 15:47
  -Yeah. -So, um, I would say that, like, as far as
• 15:50
  the user definitions are defined, I agree that the web.php is where you would go see
• 15:54
  all the user-defined things most of the time. Um, you do have to be a little bit
• 15:59
  careful if you're migrating from legacy applications, and that's the situation
• 16:02
  here. That's why we ran into this, is we've... You know, we've been on this
• 16:05
  since Laravel 4, and so this very particular application has been upgraded
• 16:09
  to 4, 5, 6, 7, 8, 9, 10, 11, 12. And so, 12-
• 16:12
  -Yeah -... is when it sort of-
• 16:13
  -Yeah -... dropped support for it and caused some
• 16:14
  issues for us. The one thing I will say that is helpful, and maybe the reason why,
• 16:20
  um, what you were talking about, is like if you wanted to resolve something out of
• 16:24
  the constructor in order to be able to apply that to a middleware or s- pass that
• 16:27
  in as something to the middleware, it's possible that at one point that was not
• 16:31
  available. But obviously now you can make your own middleware classes and things
• 16:34
  like that, so it's not a problem. Um,
• 16:37
  but
• 16:38
  if there is a middleware that you want to apply to every single method inside of
• 16:42
  that controller,
• 16:45
  it is possible for someone to miss that when they're defining a new route for that
• 16:49
  controller, right? Maybe they don't look and see the other places. Maybe that
• 16:53
  control... Maybe the, the locations where, uh, those are defined are not co-located.
• 16:58
  Maybe they're just adding a new one to the bottom of the list and they don't go
• 17:01
  find it. That controller middleware, uh, is not gonna be applied now. And so,
• 17:06
  that could be problematic. Now, that's... Maybe there's ways around that. Maybe you
• 17:11
  can put an architecture test in place. But that was the particular argument that I
• 17:14
  had, which was like, it's not necessarily all bad to be able to define it in the
• 17:18
  controller. I can see the arguments for why you maybe wouldn't,
• 17:22
  -but I don't think it's- -Mm-hmm
• 17:24
  ... I don't think it's that bad. I don't know. I don't know.
• 17:26
  Yeah.
• 17:27
  I'm just trying to look back on when, when it was actually... 'Cause there's nothing
• 17:33
  in the Laravel 12 upgrade guide that I can see
• 17:36
  that's obvious that says this has been
• 17:39
  removed. So...
• 17:41
  -All I know is it was throwing an error. -Controller middleware.
• 17:43
  -Yeah. -Oh no, it's still here.
• 17:44
  -It was throwing an error. -Controller middleware.
• 17:46
  -Go ahead. Yeah, maybe just- -Ouch
• 17:47
  -... maybe the way that we defined it. -Oh, you put it... Yeah. So used to be in
• 17:52
  a, um,
• 17:55
  cons- in the construct method, and now you can define it as a stat- a public static
• 18:01
  method that returns an array inside the controller.
• 18:04
  I got it.
• 18:05
  -So it's still able to be used- -And you, and you implement the has
• 18:07
  -middleware -... just not in the same way. Oh, I see. I
• 18:09
  -see. -Mm-hmm.
• 18:09
  Yep. Just not in the same way. Okay. Fair enough.
• 18:13
  Fair enough. Middleware may be assigned to the controller's routes in your routes
• 18:16
  file. You may find it convenient to specify middleware within your controller
• 18:20
  class. To do so, your controller should implement the HasMiddleware interface,
• 18:24
  which dictates that the controller should have a static middleware method. From this
• 18:28
  method, you may return an array of middleware that should be applied to the
• 18:31
  controller's actions, and you may also define ControllerMiddleware as closures-
• 18:37
  -Hmm, interesting -... which provides a convenient way to
• 18:38
  define an inline middleware without writing an entire middleware class. But it
• 18:43
  doesn't,
• 18:45
  doesn't really say why or when you would do this-
• 18:49
  -Sharp knives -... which I guess is... You know, sharp
• 18:51
  knives, right? Laravel
• 18:53
  provides many ways to do the same thing. I would, I would posit that doing it inside
• 18:59
  of the controller is potentially a less,
• 19:04
  um,
• 19:05
  what's the word?
• 19:07
  Like, a less conventional way of doing it.
• 19:08
  -I agree. I do agree with that. -But, you know, it's documented. Um,
• 19:12
  yeah. I don- I mean,
• 19:14
  yeah, i- for... I wouldn't do it in the controller for the same reason that I
• 19:18
  wouldn't,
• 19:19
  that I don't subscribe to, to doing route definitions inside of the controller.
• 19:23
  -And that's fair. -Um...
• 19:25
  I, I do get that. Yeah, and, and so it sounds like it's not necessarily... Th-
• 19:29
  the method by which we were using it is deprecated, but the, the idea itself-
• 19:32
  -Mm-hmm -... is still very much documented and
• 19:34
  relevant inside of Laravel. So, fair enough. I, I think that's, uh... You know,
• 19:39
  it's again, sharp knives, use them if you want to, uh, if you don't... If you cut
• 19:42
  -yourself- -Yeah
• 19:42
  ... don't complain, right? Just deal with it. So...
• 19:45
  Yeah.
• 19:46
  It's certainly like a top level documentation item.
• 19:48
  -Yeah. -Right? It's
• 19:50
  in, on this page, introduction, writing controllers, controller middleware. So
• 19:53
  it's not hidden. It's not one of those things that, like, gets pushed
• 19:57
  down the documentation until one day it disappears and then you know that it's...
• 20:01
  It,
• 20:02
  it likely won't ever be removed.
• 20:05
  Eh, in, you know, the way that Laravel typically handles deprecations, is just
• 20:08
  that at some point
• 20:10
  it's determined to be not the best practice or, you know, there's another way
• 20:13
  of doing it that's, that's more appropriate or more, uh, efficient or
• 20:17
  whatever else. And so the documented approach becomes the way to do things, and
• 20:21
  stuff that drops out
• 20:23
  might get deprecated eventually, you know, in two or three major releases time. But,
• 20:29
  um, it typically survives even though it's not documented. So it's still, still
• 20:34
  there as a top level thing. But
• 20:36
  yeah, I don't, I don't see where this... I, I'd have to dig to find out, you know,
• 20:40
  why you would do it in a constructor. Like, what, what was the documented reason
• 20:44
  -for doing it- -Yeah
• 20:45
  -... essentially? -Yeah. I, I don't even know if I could tell
• 20:47
  you in this case. I, I think it... This one is honestly just... It was like a
• 20:50
  authorization check to see if somebody had a particular role or something like that,
• 20:54
  -that's all it was. -Mm-hmm. Mm-hmm.
• 20:56
  Like, "Can they do this particular thing?" If they can't do this particular thing,
• 21:00
  then there's no reason for them to see the view, the update, the create, the delete.
• 21:03
  Th- they shouldn't be able to do any of that stuff, like, don't bother even-
• 21:06
  -Right -... doing a policy on it. There was...
• 21:07
  This was before policies were a thing. You just said, "At the controller level,
• 21:10
  don't bother, just abort. Before they ever do anything with it, just abort."
• 21:15
  Which brings me to my next question.
• 21:18
  Um, unless you have anything else you wanna talk about, which I... So, I've got
• 21:22
  -one more thing and that's- -No, no, go for it.
• 21:24
  -Okay. Okay. -Are you... You meant, you, you, you
• 21:26
  floated this, like you got in early with this one, so you've... It's obviously on
• 21:30
  -your mind- -It is
• 21:30
  -... so let's talk about- -Yes. Okay. So we talked about this with
• 21:33
  the other devs on the team earlier today. Okay. So
• 21:36
  I'm gonna try and set up the world for you a little bit and then we can chat. And I
• 21:41
  think you can help me point out maybe some p- some potential flaws,
• 21:45
  or maybe not flaws but pitfalls that I might be looking into or that I might need
• 21:49
  to investigate and/or better ways to structure this. Okay, so here it is.
• 21:53
  -Mm-hmm. -Let's say I have 20 apps, which I do, and
• 21:57
  let's say that each of those applications has, currently has their own roles.
• 22:02
  And the way that we're checking permissions or abilities inside of any of
• 22:06
  these locations and inside of any of these applications is only through checking of
• 22:10
  if a user has a role. Okay? So that is, that is the way that we've done it. Now,
• 22:15
  the problem with that
• 22:17
  is that the onl- if you only define roles, the only way to give somebody permission
• 22:22
  to do something is to assign them a role.
• 22:26
  Does this make sense?
• 22:28
  -So- -Mm-hmm. Yep
• 22:28
  ... if you have a person, let's say that there's a manager who's stepping out for a
• 22:31
  week and they have a person on their team who's like their number two, right,
• 22:36
  assistant to the regional manager if you will. And they need this , they need this
• 22:40
  user to sort of take their place, interim, uh, manager, uh, for a week. The only
• 22:46
  way, i- but they really only need them to do one part of their job, which is that
• 22:49
  they need to run this report every day and send it to the CEO. Let's say that's the
• 22:53
  -deal. -Yeah.
• 22:53
  Right? That's it. That's all they need to do.
• 22:55
  But because the only way to give them that permission is to assign them that role,
• 22:59
  in addition to getting the ability to run the report, they also get the ability to
• 23:02
  put in coaching entries or reprimand other peop- or s- read entries for other
• 23:08
  teams', um, employees or team members that are on that team, right? Not what you're
• 23:11
  -asking for, not what you're looking for. -No.
• 23:13
  Certainly, like, not a least privileged situation. And so what we're running into
• 23:18
  is that we have people who have permissions that they should never have
• 23:21
  just because they were given them temporarily and then they were never
• 23:25
  removed. Right? So the only way that we can catch this is if we do these audits,
• 23:29
  which we end up doing, but it's a big pain in the neck. And there are ways, there
• 23:32
  are better ways to do this. So,
• 23:35
  I'm gonna ex- I'll explain to you sort of our proposition and then I'll continue to
• 23:40
  kinda go through how we wanna manage it. The proposition is in any place where we
• 23:43
  have a HasRoleCheck, we're gonna remove that HasRoleCheck and we're going to name
• 23:48
  the thing that they're trying to do at that check. So, instead of
• 23:54
  HasRole, we're going to s- HasRoleManager, we're gonna say CanRunReports. In that
• 23:59
  spot, that one spot where they check to see if they ha- if they're a manager.
• 24:03
  Instead we're going to say name that thing that they're trying to do, they're trying
• 24:06
  to run a report, and then we're going to ask the question User CanRunReports.
• 24:11
  Right? Okay. So we're going to change it from a role to a permission or ability.
• 24:15
  Permission and ability are the same word, essentially. Which do you prefer?
• 24:22
  Mm-hmm. I I think the, the general advice, like the 90%, 95% use case, is to assign
• 24:28
  -roles and check permissions. -Okay. Permissions.
• 24:30
  It's certainly the way that, that we operate, is that we will always check that
• 24:34
  -the user can do something. -Yeah. Okay.
• 24:37
  We would never... Well,
• 24:39
  I say never. In our modern stuff , in our new stuff, it's always a permission check.
• 24:45
  Okay.
• 24:45
  Uh, or a policy check or whatever else. Previously, in our old code, it w- it was
• 24:51
  -base... Like, we would assign roles. -Yeah. Yeah.
• 24:53
  We had a permissions table, but p- but permissions were never implemented, so it
• 24:56
  was always like, "Is... Does this user have a role?"
• 25:00
  -Yeah. -We would always check are they an admin,
• 25:01
  -are they a manager. -Yep.
• 25:02
  Are they a group manager. We had, um... And, and like you say, that then means
• 25:07
  that that person has access to everything
• 25:11
  that that role enables them,
• 25:13
  um, whereas you want, typically, I think, your permissions to be as granular as
• 25:19
  possible.
• 25:20
  Yes. The... Yes, correct. I agree with all of that. Um, my question specifically is,
• 25:25
  when we're talking about that, you're using the word permissions to talk about a
• 25:28
  granular level thing that they can do. Another word that I've heard used for that
• 25:32
  -is ability. So, my question is- -Mm-hmm
• 25:34
  ... for the remainder of our discussion, would you prefer me call them permissions
• 25:37
  or abilities?
• 25:41
  It depends on what you... If you're just using Lyro stuff, I'd call them
• 25:44
  -permissions. -Okay. So, yeah, permissions. And that's
• 25:46
  -what my guys sort of said too. They said- -And you-
• 25:48
  ... "Oh, we like to call them permissions instead of abilities." 'Cause I've called
• 25:50
  -them abilities- -Yeah
• 25:51
  ... in the past, and I th- we can call them-
• 25:52
  -Yeah -... permissions. That's fine.
• 25:53
  -It's a bit... Like, I think bouncer? -Yes.
• 25:56
  'Cause I know you've used bouncer in the past.
• 25:57
  Well that, well that's because of abilities.
• 25:57
  Bouncer refers to the roles and abilities.
• 25:59
  -Yeah. Yeah. -Yeah, right. Um, I think... How would you
• 26:01
  -think about this? -And then there are no permissions, we're
• 26:03
  first giving out permissions.
• 26:05
  Yeah.
• 26:06
  Like, you have permission to do something, but you have the ability
• 26:12
  to
• 26:14
  -enact that, that something, right? -Yeah. Yeah.
• 26:17
  So, I think it depends on which way you're looking at... You know, is the user
• 26:21
  the one that... You know, does the user have the ability to do this thing?
• 26:26
  -It- -I know. They're, they're synonymous.
• 26:29
  -The user has the ability- -They're synonymous. Yeah.
• 26:30
  Or does the user have the permission? Yeah.
• 26:32
  Yeah. And so, I'm just trying to establish, like, uh, the domain language
• 26:34
  for our team, like, whether we're gonna be using the word ability, permission. I've
• 26:38
  -used the word ability- -Yeah
• 26:39
  ... but I think we're switching over to using the word permission.
• 26:40
  Sounds like if the rest of your... Yeah, I was gonna say, it sounds like if the rest
• 26:43
  -of your team- -Yeah
• 26:43
  -... is using permission- -Yeah, that's the word that they would like
• 26:45
  -to use -... then, then you're using permission.
• 26:47
  -Agreed. -Um, and like I said, I, I think the, the
• 26:50
  fact that
• 26:51
  ability is in your head is probably owing to the fact that you used-
• 26:54
  -100% -... that you've used bouncer in the past
• 26:55
  -as well. -Yes, it is.
• 26:56
  But, like, the Sparcy, Sparcy has a permissions package.
• 26:59
  -Yeah. -I think generally when people speak about
• 27:01
  -it, it's permission rather than... Yeah. -Yeah. Okay. So,
• 27:05
  we've got permissions, right? In every spot where we're doing the HasRole, we're
• 27:09
  going to check, uh... Instead of HasRole, we're gonna say HasPermission essentially.
• 27:12
  Think about it that way, right? So, we're gonna make everything very granular, and
• 27:17
  so our application will check for permissions. Now,
• 27:21
  the second part of this is imagine that across those 20 apps, you know, every app
• 27:27
  has its own set of permissions that, that are a part of that, right?
• 27:32
  -Now- -Mm-hmm
• 27:33
  ... who manages those permissions is the question. Who gets to manage those? Well,
• 27:38
  I will tell you, my preference is that I never ever manage those. I want my team to
• 27:43
  write the code that enables people who have that permission to do that thing.
• 27:49
  -That's what I want my team to do. -Mm-hmm.
• 27:50
  But I do not want my team to manage permissions. I want the IT staff to do
• 27:55
  that.
• 27:56
  -Um- -Right
• 27:56
  ... and
• 27:58
  for them,
• 27:59
  even only in a limited capacity. So, um,
• 28:03
  what I would like to have happen then is if you can think of a
• 28:08
  different application... So you have these 20 applications that live on the bottom
• 28:11
  level there, and all those le- all those are doing is they're checking for
• 28:14
  abilities. So, there is essentially no,
• 28:17
  no concept of roles anymore in those. We're gonna rip those out of that
• 28:21
  application. No roles anymore. It's just permission checks. We're gonna go up a
• 28:27
  layer, and now you're gonna have an application, uh, one layer above that
• 28:31
  knows about all the different applications
• 28:34
  and then knows about all the different roles in those applications, and then
• 28:38
  groups together different permissions for those particular roles.
• 28:44
  -Mm-hmm. -Does that make sense? Now, that
• 28:45
  application that sits above that is active directory, essentially, is the idea,
• 28:49
  -right? -It's exactly what that is. Yeah.
• 28:51
  I mean, that's what it is. And so, and so what we're thinking is, like, why reinvent
• 28:54
  the wheel on that? E- essentially what we do is we have a user,
• 28:58
  and that user will have a job function, which is essentially their job title,
• 29:03
  right? So if I have a banking manager,
• 29:07
  um, that banking manager is going to have specific permissions inside of each of
• 29:12
  those 20 different applications, right? Inside of some of those applications, they
• 29:17
  may have a role of manager. So, like in the case of, like, coaching, right?
• 29:23
  -Mm-hmm. -Because they're a manager, they're going
• 29:25
  to have likely a coaching manager role inside that application, but the
• 29:30
  application doesn't know anything about that. All it knows about at the end of the
• 29:34
  day is which permissions that user was granted when they come in.
• 29:39
  The way that this will be structured then in Active Directory is you will have a
• 29:43
  coaching_,
• 29:45
  so it's actually namespaced in Active Directory. App_coaching, which is the name
• 29:50
  of the app, _role or ability. So,
• 29:54
  app_coaching_manager. That's the role, right?
• 29:58
  -Mm-hmm. Mm-hmm. -And then nested underneath that
• 30:02
  would be additional security groups that would apply to that particular role,
• 30:07
  right? So app_coaching can add new coaching log.
• 30:12
  App_coaching-
• 30:14
  -Yep -... can run coaching reports.
• 30:16
  And those abilities may only live under app coaching manager, but they also may
• 30:20
  run under... May live under app coaching admin.Right? So those abilities have
• 30:26
  basically a one-to-many relationship between-
• 30:29
  -Mm-hmm -... those, uh, those different security
• 30:32
  groups. Okay? And then each user would get assigned to one of those security roles.
• 30:37
  Okay. The reason why that's all important is because
• 30:40
  when a user is created in the system, they will get a single
• 30:45
  set of
• 30:47
  roles. That's it, that's what they get. They get the ones that belong to their
• 30:51
  particular job function and nothing else.
• 30:54
  -So if- -Mm-hmm
• 30:55
  ... that user that was previously mentioned needs to take over for their
• 30:59
  manager for a week to run that report,
• 31:03
  instead of giving them
• 31:06
  app_coaching_runreport, or sorry, a- app_coaching_manager, they would get the
• 31:12
  ability of app_coaching_cannrunreport. They would get that single ability rather
• 31:17
  than the manager role. Now here's the really interesting thing.
• 31:21
  We are going to say that anybody who needs an additional permission outside of the
• 31:26
  ones that apply to their specific role, they only get a lease on that permission.
• 31:33
  -Yeah. -Does that make sense? So it's-
• 31:34
  -Yep -... expiring, meaning that they can ask
• 31:37
  for it for a period of time, and then after that, it goes away. It gets removed-
• 31:42
  Yeah
• 31:42
  -... from their user- -Yeah
• 31:43
  ... so that we don't end up with this mess of what we're talking about, where a user
• 31:46
  gets a permission and it just is signed forever. So you have somebody who started
• 31:50
  in one team and they've moved three times, and now they have inherited permissions
• 31:53
  for every single team they've ever been on.
• 31:55
  -Yeah. Mm-hmm. -Which is a freaking disaster mess.
• 31:58
  -Um- -Yeah
• 31:59
  ... and it's really unclear what they actually still need and what they don't
• 32:02
  -because they were never removed. -Mm-hmm.
• 32:05
  -Yeah. -And so
• 32:06
  that's the big picture of what we're trying to-
• 32:07
  -So- -... accomplish. Yeah.
• 32:09
  Mm-hmm. So are these, the expiring permissions, are they being managed inside
• 32:14
  of Active Directory, or are you doing that, like some scheduled task that goes
• 32:19
  through and, and cleans up these permissions where expiry date is in the
• 32:23
  -past? -Yeah, you got it. And so it's actually a
• 32:25
  little bit silly. We're using AD LDAP, so Active Directory-
• 32:28
  -Mm-hmm -... L- LDAP. What is, uh, listing
• 32:31
  directory? I don't know. It's, like, that protocol basically that lets you-
• 32:33
  -Yeah, yeah, yeah -... talk to those things.
• 32:35
  -Yeah. -And what we do is when somebody wants an
• 32:37
  additional permission, we can say, "Okay, they want..." You know, select the
• 32:40
  application you're trying to get permissions for. Coaching. "All right,
• 32:43
  here are all the ab- roles and the abilities that are available for you to
• 32:47
  lease." "Okay, I want to be able to run the report." "Okay. When does it, when
• 32:51
  does it expire?" "It expires in, in a week." And then they say, "Okay, request."
• 32:55
  Their manager has to look at it, approve it, and once their manager approves it, it
• 32:59
  will then
• 33:00
  send that off to our auth application, and then that thing actually adds that, uh,
• 33:07
  group...
• 33:09
  -Uh, sorry, adds that user- -Mm-hmm
• 33:10
  -... sorry, to that group. -Yeah.
• 33:13
  And then
• 33:14
  it will, you know, check the end date every day at 7:00 AM, and when the end day
• 33:19
  hits, it will remove that user from that group. And then when they log in the next
• 33:23
  time, it will look at the AD groups that they are a part of and it will remove the
• 33:28
  ability that they previously had, uh, when they logged in-
• 33:31
  -Right -... last time.
• 33:32
  -Mm-hmm. -So that's the idea. Now the, the big
• 33:34
  challenges that I'm running into here is that this top level app,
• 33:38
  uh, that's going to help manage all these things has to be aware of all the
• 33:41
  different mappings that I have for these abilities inside of all these different
• 33:45
  -applications, which is- -Yeah
• 33:47
  ... that is the pain, but I don't really know of a better way to do it if I don't
• 33:52
  -want- -Yeah
• 33:52
  ... my team to manage it.
• 33:55
  Yeah. And it also means that anytime you add a permission
• 33:58
  somewhere, you've gotta do it in two places.
• 33:59
  -Yes, correct. -You've gotta do it in the app, and you've
• 34:01
  -gotta do it in the- -Active Directory
• 34:03
  -... the overseer- -Yeah
• 34:04
  -... as well. -Yeah.
• 34:04
  Yeah.
• 34:06
  But yeah, I mean, and, and expiring permission is a good way to, to deal with
• 34:12
  it, I think, especially from a compliance perspective.
• 34:14
  -Yeah, exactly. -You know, no one should have access to
• 34:16
  things that they shouldn't have access to, so having that-
• 34:18
  -And we can see when they requested it -... That's amazing. And it's like...
• 34:20
  Yeah. Yeah, if you're keeping audit trail of it, that's, that's gonna be helpful for
• 34:24
  that kind of stuff as well, 'cause you know that no one's got access to anything
• 34:27
  that they shouldn't. And if they do, you know, they shouldn't typically have access
• 34:31
  to it. You know when they requested it, when it was approved, by who, and when it
• 34:34
  was removed. And, um,
• 34:39
  yeah, I mean, it's no different to how when you create GitHub tokens and things
• 34:42
  like that, you can request for it to be, you know, seven days or 30 days or 90 days
• 34:46
  or, or, or unlimited. And as much as it annoys me every 30 days to have to, to
• 34:50
  -roll a token- -I know, right
• 34:51
  ... I think probably having a, a 30 day token is, is still the, the correct answer
• 34:55
  for most things.
• 34:57
  -Yeah, there's, um, the- -Spreaker. Spreaker on the pitch.
• 34:59
  Yeah. Oh, he's
• 35:01
  ...
• 35:02
  He-
• 35:02
  he's got his, uh, he's got his pajamas on. Harrison, you wanna say hi
• 35:07
  real quick? Come here. Come here. Yeah, that's fine.
• 35:09
  -The baby of the bunch. -Har- come say hi here. Hold on. Hold on.
• 35:12
  Let me put your head phone.
• 35:14
  -Look at him. -Say, say hey, Michael.
• 35:16
  Hi, Michael. So big.
• 35:18
  Hey, man. How you doing?
• 35:20
  He's s-
• 35:20
  -He's doing good. -I remember the, the last time I saw him
• 35:22
  was teeny tiny in a pram
• 35:25
  in New York.
• 35:27
  -That's how long ago that was. -Oh, that's right. Dude, that was Laracon.
• 35:30
  -No, look at him. -Harrison, you were in Laracon.
• 35:31
  -Yeah. -You were at Laracon with us at eight weeks
• 35:32
  old, remember?
• 35:34
  You don't remember.
• 35:36
  -I don't remember. -No, he don't remember. All right, say,
• 35:38
  say, "Hello world."
• 35:40
  Say it l- nice and loud to everybody.
• 35:42
  Hello world.
• 35:45
  -There he is. -I love the eye roll. Sorry.
• 35:46
  Sorry. Bye, Harry.
• 35:48
  Um,
• 35:49
  so, uh, yeah, what was the last thing I was gonna s- oh, here's the other piece of
• 35:54
  this which is really interesting, I think.
• 35:56
  Um, if, so
• 35:57
  when a permission is about to expire, we can send an email out and say, "Hey, you
• 36:02
  have this permission which is about to expire. If you need to extend your lease
• 36:05
  -on it- -Mm-hmm
• 36:06
  ... you can request, uh, an extension here." And they could click it. It could
• 36:10
  -fire- -Yeah
• 36:10
  ... off that extension request, and then their manager could approve it again, and
• 36:13
  then it could happen. Right. So I think it re- and so what that allows essentially,
• 36:17
  is that allows me to not only actually remove the burden from my software
• 36:20
  development team, it actually also removes the ability of my IT guys to get
• 36:24
  involved. They'll have to add new permissions-
• 36:26
  -Mm-hmm -... but they should never really have to
• 36:29
  get involved in the modifying of permissions outside of-
• 36:33
  -Yeah -... if we need to add a default permission
• 36:35
  to a particular job function or job role. Right? Um...So it'll be a little bit of
• 36:41
  like a hand in glove situation where we do need to work closely with them on some of
• 36:44
  those things. But as it is right now, it's sort of a pain the neck because
• 36:48
  they'll have to message one of the software devs and be like, "Hey, somebody
• 36:51
  said they need to run that report. What role do they need?" That's, that's...
• 36:54
  'Cause there's, it's not transparent to them at all-
• 36:56
  -Yeah -... what, what roles are needed for what
• 36:58
  particular abilities. And so
• 37:00
  it's just we're trading problems, and I think it's a better solution.
• 37:03
  Yeah.
• 37:04
  -So. -So two, two things that I just thought of.
• 37:07
  Number one, um, how easy are you making it? So if I have to go and request
• 37:12
  permission to do some report, is it fairly obvious that I'm like, "This is the
• 37:17
  permission that I want"?
• 37:18
  -Right. Like- -Are you naming them in such a way? 'Cause-
• 37:21
  Yeah
• 37:21
  ... most, most permission stuff would be transparent to... I mean, maybe managers
• 37:26
  know what the permissions are. You know, there would be some level of knowledge
• 37:30
  there depending on their technical skill. But for most, most workers, I would
• 37:34
  imagine that they don't know what they're asking for.
• 37:36
  That's agreed. That- that's true. And I think right now, it's completely obli- n-
• 37:40
  -nobody knows. There's no good catalog- -Yeah
• 37:42
  ... of abilities, right? And so what we would have to do as part of this is we'd
• 37:46
  have to... You know, we'd give it a good name, and we've got a convention that
• 37:49
  we're using to convert the abilities, um,
• 37:52
  to good named AD security objects. And then we need to give good definitions to
• 37:58
  them as well. A- and so that'll be part of-
• 38:00
  -Yeah -... the process of converting these over,
• 38:02
  is just making sure that we give good descriptions of what they are. And then
• 38:06
  we'll probably have to do something like a package, honestly, something that's going
• 38:10
  to help to coordinate the different abilities between the different
• 38:14
  applications. Or we'll have to create an endpoint that lives on these applications
• 38:20
  where they can be hit and queried, and then they can return back those, those
• 38:24
  pieces of data. 'Cause I really don't wanna have to
• 38:27
  update...
• 38:29
  I- I don't wanna have to update a package every time I wanna add a new ability. I
• 38:31
  -don't wanna have to do that. And so- -Right
• 38:33
  ... I think if we just created an endpoint that was like, "Hey, give me all the
• 38:36
  different ability. Give me, give me your permissions catalog," and it could, it
• 38:40
  could say what those are, then we can just essentially advertise that and, you know,
• 38:45
  use an API token, go grab the abilities, uh, the abilities catalog, and then, um,
• 38:51
  push those into a config item or something like that. You know what I mean? I'm not
• 38:53
  -using the- -Yeah
• 38:54
  -... right wording here, but that- -Yeah
• 38:55
  ... that would be the idea. So yeah, that, I think-
• 38:57
  -Yeah -... that would be how you'd do it. You
• 38:58
  would try and make it as obvious as we could. So that was, that was number one.
• 39:00
  Yeah.
• 39:02
  -And you had number two. -Um, I think the, the other thing, the
• 39:04
  other thing was, you know, if, if you needed to request an extension... I mean,
• 39:09
  you, you said at the top that
• 39:12
  people would be asking for permission to do something because their manager is
• 39:15
  -going to be away. So if they need- -Ah
• 39:17
  ... to extend that, who's, who's approving that?
• 39:19
  -Yeah, no. -Because the manager's obviously, you know,
• 39:21
  -away for a bit longer, so there's- -That's a good-
• 39:23
  -... that's something to consider as well. -That's a good question. Um-
• 39:26
  Like, someone would have to approve it,
• 39:28
  -um- -Yeah
• 39:29
  ... and they would probably... Like, I would, I would say that that is more the
• 39:32
  exception than the norm, where maybe, you know, your team or IT would have to step
• 39:36
  -in and go- -Yes
• 39:36
  ... "Well, they had it."
• 39:38
  Yeah, typically, that, that has happened before.
• 39:39
  -But then you'd have- -Yeah, where, where we would have somebody
• 39:41
  -who's away- -And I think you would probably have some
• 39:44
  -rules around that as well. -Yeah.
• 39:45
  Like, you can only request one extension, or the extension can only be for two days
• 39:49
  -or something like that. -Yeah.
• 39:50
  And we did a, we did a similar kind of thing with,
• 39:55
  um, like invoices. When you've got an overdue invoice, you can request an
• 40:00
  extension. And so the, the frontline staff would have permission to request an
• 40:04
  extension, and there'd be, there was a series of rules. Like, you could, you
• 40:07
  could ask for s- uh, 14 days or seven days, but you could only ask for each
• 40:12
  once. So initially, you'd get like a 14-day buffer. And then if you had already
• 40:16
  asked for 14 days, you could only ask for a seven-day extension from there.
• 40:20
  And then there was like... that was it. And that was, like, enforcing business
• 40:23
  rules ar- around those kinds of things. Because there's also this expectation of,
• 40:28
  um... This was in telecommunications, so there's, there's a whole code of practice
• 40:32
  around, um, not
• 40:35
  l- allowing customers to get, you know, dig themselves into debt-
• 40:38
  -Yeah, yeah -... over these kinds of things that, you
• 40:40
  know, you would have to, you'd have to cut them off. You wouldn't be able to keep
• 40:43
  extending them so that you didn't keep charging them for a service that they
• 40:46
  -clearly can't pay for or- -Yeah
• 40:47
  ... or had no interest in paying for. So,
• 40:49
  um, yeah, maybe something like that where, you know, you get one,
• 40:54
  one, um, bump. You know, it gives you an extra three days or something.
• 40:59
  And then beyond that, you have to ask for a whole new thing.
• 41:02
  -Yeah. -Um,
• 41:04
  that, you know... Yeah, w- what that looks like for, for your organization and, and
• 41:08
  how you implement that or what the, what the business rules around that is,
• 41:13
  you know, up to, up to you guys. But it might be one approach that, that could be
• 41:16
  -suitable. -It's a good idea to have a maximum number
• 41:19
  of, um, extensions that you could do though. I think that's a great idea. It's
• 41:23
  -not something- -Right
• 41:24
  ... I'd thought of before. 'Cause yeah, otherwise you could just have somebody
• 41:27
  continue to request extensions and just kind of go that way. And-
• 41:29
  -Mm-hmm -... that does defeat the purpose a little
• 41:31
  bit, especially if we have, like, long-term leases.
• 41:33
  You could ask for a new... Yeah, but you could, you could ask for a new-
• 41:37
  -Correct -... extension.
• 41:37
  -Yes. Absolutely. Yeah, you- -But it would, like, you couldn't just, you
• 41:41
  couldn't have like a seven-day extension for the time that manager's away, and then
• 41:44
  you would just ask for like... I would just top that up for another three days,
• 41:47
  -another three days- -Yeah
• 41:47
  ... another three days. Like, you would wanna set a cap on that.
• 41:49
  -Yeah. -But if they, there was genuinely a need
• 41:51
  for it, you know, if the manager had delegated the responsibility of running
• 41:54
  that report to someone else, then, you know, that would just have to request that
• 41:58
  -permission, you know- -Absolutely
• 41:59
  -... and say, "Okay, yes-" -And we have, I think the solution-
• 42:02
  "... let's do it again. Here's another seven days or here's 30 days now."
• 42:04
  Yeah, the solution in that instance would be like these long-term leases that we
• 42:07
  -would have, that would be like- -Mm-hmm
• 42:09
  ... you could request up to like a six-month lease or something like that. If
• 42:12
  -you're- -Yeah
• 42:12
  ... if, you know, in some instances, maybe it'd go through an additional approval
• 42:15
  process or something where it's like, "Why are you asking for a six-month approval?"
• 42:18
  Mm-hmm.
• 42:19
  Uh, you have to have the approval of two... Or sorry, a six-month lease, you
• 42:21
  have to have the approval of two people in order to get that or something. Um, and
• 42:24
  if it was gonna be made a more permanent part of a role or delegated to somebody
• 42:27
  else, then we might need to make an additional layer, an initial role, like a
• 42:31
  training, uh, assistant. You know what I mean? Something like that role. And then
• 42:35
  they just get that ability as well. Um, but again, the nice thing about this is
• 42:40
  that if we needed to make that role, we would not have to be involved with that at
• 42:43
  all. That decision can be made higher up the chain-
• 42:45
  -Mm-hmm -... and we just check for the ability.
• 42:47
  -Yeah. -So it's really nice.
• 42:49
  -Yeah. -It allows the IT teams-
• 42:50
  -Yeah. The roles can be created whenever. -You got it.
• 42:52
  Yeah, roles can be created whenever, as long as they're composed of existing
• 42:55
  -permissions. -You got it exactly right. And so I think
• 42:57
  that really frees them up to do a lot of work. Now-... um, the, the trick is naming
• 43:03
  the abilities well, and then the second trick is making sure that they kinda stay
• 43:07
  in sync across this, uh, orchestrating, uh, entity that, th- that sits above it.
• 43:13
  And so...
• 43:14
  That's it. That's it, but I, I think, I think that works. Um,
• 43:19
  and I think we actually might be able to get away without using permissions or
• 43:23
  bouncer, Laravel permissions or bouncer, actually. Because we already have...
• 43:27
  -Mm-hmm -... a process by which when a user logs
• 43:29
  in, we look at all the security groups they're a part of, and we can inspect that
• 43:34
  and assign permissions,
• 43:36
  uh, it's basically just an array. It's just an array of permissions-
• 43:39
  -Yeah -... which would be an enum cast
• 43:41
  of, you know, w- of AD groups, AD security groups mapped to named permissions. And
• 43:48
  we'll just cast them to an enum on that user and that's it.
• 43:50
  -Yeah. -There's no, there's no need for, like,
• 43:52
  -this one- -Yeah, I think-
• 43:52
  ... to many whatever, because we're not gonna do roles inside of the application.
• 43:56
  Right. Yeah. I think if, if the permissions for your application are
• 43:59
  coming from something like Active Directory, then there's, there's no need
• 44:02
  to
• 44:03
  -layer the package on top. -Agreed.
• 44:05
  As long as you've got some way of translating those things into... You know,
• 44:10
  I mean, you could d- dynamically register policies or whatever else, or, or gates
• 44:13
  -and things like that- -Mm-hmm
• 44:14
  ... based on this. And then, whether you cache that, you know, for
• 44:19
  24 hours, do you cache that just for the request, like do you use-
• 44:22
  -It's... Yeah, just for the session -... it once or whatever?
• 44:24
  -Yeah, it's just... Yep. -Yeah.
• 44:24
  Yeah, and when they log in again, it does the check again. So it, it goes and talks
• 44:28
  to AD and says give me the list of, uh, security groups they have.
• 44:31
  -So you're not- -Yeah.
• 44:33
  So how are you, how are you dealing with, like, changing in permissions if, if
• 44:37
  -someone like- -Doesn't log in?
• 44:38
  -... has a permission unassigned- -Yeah, right
• 44:41
  -... while, like, during a session? -This is a good question. And, and this is-
• 44:44
  Are you-
• 44:45
  I don't have a good solution to this. This is a good, this is a good question to
• 44:48
  ask.
• 44:49
  So, wh- what I will say is like right now, and the way that they've had to do it,
• 44:52
  like if they've had to add a permission is they'll add the permission and then
• 44:54
  they'll ask the user to sign out and sign back in,
• 44:56
  right? They sign out, they sign back in, when they sign back in-
• 44:59
  -Yeah. Yeah, adding, adding is fine. -Yep.
• 44:59
  Because someone, because someone wants that, I want extra things-
• 45:02
  -Yes -... yeah, I'll do, do the work to sign out
• 45:04
  -and sign back in. -Exactly. Now, the question is-
• 45:05
  -But if you are having some permission- -... do we revoke that?
• 45:07
  -... revoked. -Yeah. Yeah.
• 45:08
  -Yeah. -Now, the way that we've got it set up
• 45:10
  -right now- -Or, or if, or if it's a lease that it
• 45:11
  -expires- -Yeah
• 45:12
  ... like it's gonna have to log you out somehow.
• 45:14
  Yeah, so the way that we do it right now is, yeah, the thought is that we expire
• 45:18
  the lease at like 6:00 AM. So at 6:00 AM on that day we say it should expire this
• 45:23
  day, we revoke it. And if they haven't logged in that day, which it's very
• 45:25
  unlikely that they have, then when they log in that day-
• 45:29
  -Mm-hmm -... the permission will be revoked. Now,
• 45:31
  in some weird case where we needed to revoke a permission for somebody
• 45:37
  in the middle of the day, which I, I don't really see that happening. We don't
• 45:40
  typically get requests to take permissions away. We get plenty of requests to add
• 45:45
  permissions, but almost never. The only case I can think of where we say like we
• 45:50
  would revoke permissions would be when somebody's getting terminated.
• 45:52
  -You know, that happens. -Mm-hmm.
• 45:54
  -But typically the way that that works is- -Yeah
• 45:56
  ... a manager will set a time to say, "Hey, at 1:00 we're gonna have the
• 45:59
  conversation with this person, we need to terminate this user at 1:00." And so
• 46:02
  they'll pull them in, the IT team schedules the termination for 1:00, they
• 46:06
  then revoke that user's access and then by the time they get back to their machine,
• 46:09
  it's locked and they can't get logged back in and it's fine. So-
• 46:12
  Yeah.
• 46:13
  I don't... It's, it's a, it's an interesting question to posit but I'm not
• 46:17
  sure
• 46:18
  that it's a critical component of what I'm hoping to accomplish. I, I don't-
• 46:23
  -Yeah. -I don't know.
• 46:26
  Yeah. And, and I assume in an organization like yours you'd have a risk register
• 46:30
  somewhere, and these are the kind of questions that I sit there and I come up
• 46:34
  with and I send it to the risk team, and they put it in the risk register and we
• 46:37
  say, "Okay, we know about this but we don't care about it."
• 46:39
  -Yeah, exactly. -And as long as it's in the risk register-
• 46:42
  -Yes -... you know, it has been raised, it is,
• 46:44
  you know, we've decided that it's not something that we're terribly concerned
• 46:47
  -with, fine, but it's been noted. -Exactly. We mark it as an acceptable risk.
• 46:50
  And it's better to have something on the
• 46:50
  -risk register- -Yes.
• 46:52
  Yeah, right, yeah, yeah. And it's better,
• 46:54
  for those of you listening who are in, in smaller organizations or you're, you know,
• 46:58
  on your own or whatever,
• 47:00
  it's probably fine, you don't have to worry about it. But in, in big
• 47:03
  organizations especially those that are, you know, ISO 27001 or their SOC 1, SOC 2,
• 47:09
  whatever else, these are the kinds of things that it's, it is okay
• 47:14
  to have these kinds of things sat on a risk register and you just say, "That's a
• 47:19
  low risk, medium risk, it's acceptable," you know, we don't care about it but we,
• 47:23
  b- but you still need to think about these kinds of things.
• 47:25
  -Absolutely. -And then what you do with it is you just,
• 47:28
  you decide, is it something that I need to, to put into code to protect against?
• 47:33
  Or, is it okay to just, just to acknowledge that yes, that is something
• 47:36
  that we are aware of, but we're not worried about it being an actual concern?
• 47:40
  Yeah. I- so the two words that we typically use in those instances is that
• 47:44
  we would say number one, it's a known, it's a known risk but it's a,
• 47:49
  it's A,
• 47:50
  it is an acceptable risk, and B, here is a compensating control.
• 47:55
  Auditors love that phrase, a compensating control which just means we're aware of
• 48:01
  this issue but we're solving it in a different way. So we would say the
• 48:04
  compensating control is referenced user termination policy line 15, right? Where
• 48:09
  it says, uh, you know, all user terminations will happen within 15 minutes
• 48:15
  of a termination request or at the scheduled time requested by the manager.
• 48:18
  And then you, you know, you basically reference, hey, here's the pla- place
• 48:22
  where we say this is how we do it and this is why it's not a concern. That the
• 48:25
  application handles it because our process handles it this way. Um, and so anyway,
• 48:31
  those, those are good points to bring up, especially when you're trying to do those
• 48:35
  things, SOC 1, SOC 2. If an auditor brings that up and you don't have a solution for
• 48:39
  it like in code, i- if you have a solution for it in policy, um, then that's
• 48:43
  usually good enough, so...
• 48:46
  Yeah. Yeah.
• 48:48
  -Well folks, that's all I've got. -Cool.
• 48:49
  Michael, you got any... Uh, thanks for your help on that. I, I appreciate you
• 48:52
  thinking through that with me. Um,
• 48:55
  I think we're gonna move forward with that and I'll let you know kinda how things
• 48:59
  go, uh, on that front. But, I think it'll be good. I think it's definitely gonna be
• 49:02
  an improvement over what we've been doing.
• 49:05
  -Yeah. Yeah, I think so. -Yeah. Yeah. So...
• 49:07
  For sure.
• 49:08
  All right my friend, Episode 179 of the North Meets South web podcast is in the
• 49:13
  books. If you'd like to find show notes for this episode find them at
• 49:15
  northmeetsouth.audio/179. If you'd like to talk to us on Twitter, on X, on all the
• 49:22
  things, hit us up @michaeldurant, @jacobbennett or @northsouthaudio. And if
• 49:26
  you liked the podcast we'd really appreciate it if you'd rate it up in your
• 49:30
  podcatcher of choice, five stars would be absolutely incredible. Folks, we hope to
• 49:33
  see you at Laracon, please say hello. We would love to talk to you in person. We
• 49:38
  don't get to see any of you. Typically, for us this feels like speaking into the
• 49:42
  void. It feels like nobody's listening to this ever until we get there and we hear
• 49:46
  from all of you wonderful people. It's an encouragement every year to keep going-
• 49:49
  -Oh -... and keep doing it, because...
• 49:51
  I, I, I enjoy it. I think it's, it's good to know that people do listen but it's
• 49:55
  -also a very bizarre experience. -Mm-hmm.
• 49:57
  Because people know so much about you and you're like, "Hello person."
• 50:01
  Oh, that's so funny.
• 50:03
  -Yeah. -Don't let that deterr- d- don't, don't let
• 50:05
  that deter you from doing it though, I love, love to meet the people. Um, and
• 50:09
  it's been, you know, like I said, six years since I got to meet the people.
• 50:12
  -Absolutely. -So. Except for those of you who are kind
• 50:14
  and caring enough to come all the way down to Laracon AU.
• 50:17
  One of these years I'm gonna get there folks.
• 50:19
  All right everybody.
• 50:21
  Till next time, we'll see you.