Restrict User Actions with Time-Based Sanctions Using Laravel Prohibitions

In the world of web applications, user management is a critical aspect that can significantly affect the overall experience and security of the platform. One common requirement is the need to temporarily restrict user actions based on certain behaviors, such as spamming or violating community guidelines. Laravel, a popular PHP framework, offers a robust solution for this through its Prohibitions package. This article will explore how to implement time-based sanctions using Laravel Prohibitions, allowing developers to manage user actions effectively.

Understanding Laravel Prohibitions

Laravel Prohibitions is a package designed to facilitate the temporary restriction of user actions. Developed by Kyrch, this package allows developers to store time-limited restrictions in the database, enabling dynamic application and lifting of these restrictions without the need for code changes. This flexibility makes it suitable for various scenarios, including:

• Content moderation
• Rate limiting enforcement
• Account suspensions
• Temporary feature lockouts during investigations

The package distinguishes between individual prohibitions, which restrict single actions, and sanctions, which group multiple prohibitions together for easier management. This structure allows developers to create a nuanced user management system that can adapt to different situations.

Installation of Laravel Prohibitions

To get started with Laravel Prohibitions, you will first need to install the package via Composer. Here are the steps to follow:

1. Run the following command in your terminal to install the package:

composer require kyrch/laravel-prohibitions

2. Publish and run the migrations to set up the necessary database tables:

php artisan vendor:publish --tag="laravel-prohibitions-migrations"

php artisan migrate

3. Optionally, you can publish the configuration file for further customization:

php artisan vendor:publish --tag="laravel-prohibitions-config"

Setting Up Your Models

Once the package is installed, the next step is to set up your models to utilize the prohibitions functionality. To do this, you need to add the HasSanctions trait to any model that can be prohibited from performing actions. For example, if you want to restrict actions for the User model, you would modify it as follows:

use KyrchProhibitionTraitsHasSanctions;

class User extends Authenticatable {
    use HasSanctions;
}

Creating Prohibitions and Sanctions

With your models set up, you can now create individual prohibitions and group them into sanctions. Prohibitions represent specific actions that can be restricted, while sanctions allow for the management of multiple prohibitions at once. Below is an example of how to create prohibitions and a sanction:

use KyrchProhibitionModelsProhibition;
use KyrchProhibitionModelsSanction;

// Create individual prohibitions
$sendMessage = Prohibition::query()->create(['name' => 'send message']);
$createComment = Prohibition::query()->create(['name' => 'create comment']);
$joinGroup = Prohibition::query()->create(['name' => 'join group']);

// Group prohibitions into a sanction
$communitySanction = Sanction::query()->create(['name' => 'community restriction']);
$communitySanction->prohibitions()->attach([$sendMessage->id, $createComment->id, $joinGroup->id]);

Applying Restrictions

After creating prohibitions and sanctions, you can apply these restrictions to users. You can prohibit a user from performing a single action for a specified duration or apply a sanction that restricts multiple actions simultaneously. Here’s how to do it:

// Prohibit a user from sending messages for one week
$user->prohibit('send message', now()->addWeek());

// Apply the grouped community sanction for two weeks
$user->applySanction('community restriction', now()->addWeeks(2));

Checking Prohibition Status

Before allowing a user to perform a restricted action, it is essential to check whether they are prohibited from doing so. This can be done using the isProhibitedFrom method. Here’s an example of how to implement this check:

if ($user->isProhibitedFrom('send message')) {
    return response()->json(['error' => 'You are currently restricted from sending messages.'], 403);
}

Integration with Laravel Authorization

To ensure consistent enforcement of prohibitions across your application, it is advisable to integrate these checks into your authorization layer. You can do this by adding a check in your Gate::before() callback or within individual policy methods. Here’s how to implement both approaches:

Using Gate::before()

use AppModelsUser;
use IlluminateSupportFacadesGate;

Gate::before(function (User $user, string $ability) {
    if ($user->isProhibitedFrom($ability)) {
        return false;
    }
});

Using Policy Methods

namespace AppPolicies;

use AppModelsConversation;
use AppModelsUser;

class MessagePolicy {
    public function before(User $user, string $ability): ?bool {
        if ($user->isProhibitedFrom($ability)) {
            return false;
        }
        return null;
    }

    public function send(User $user, Conversation $conversation): bool {
        return $conversation->participants->contains($user);
    }
}

Event Handling

Laravel Prohibitions also provides event handling capabilities. When prohibitions and sanctions are triggered, events are fired, allowing you to log moderation actions or notify users accordingly. The following events are available:

• ModelProhibitionTriggered — fired when a prohibition is applied
• ModelSanctionTriggered — fired when a sanction is applied

If your application does not require event handling, you can disable these events in the configuration file.

Use Cases for Laravel Prohibitions

Laravel Prohibitions can be utilized in various scenarios, making it a versatile tool for developers. Here are some common use cases:

• Content Moderation: Temporarily restrict users from posting content if they violate community guidelines.
• Rate Limiting: Prevent users from sending too many messages or comments within a specified timeframe.
• Account Suspensions: Suspend user accounts for a certain period due to violations or suspicious activities.
• Feature Lockouts: Temporarily disable specific features for users under investigation.

Conclusion

Implementing time-based sanctions using Laravel Prohibitions provides a robust framework for managing user actions effectively. By utilizing this package, developers can create a more secure and user-friendly environment, ensuring that users adhere to the platform’s guidelines. The flexibility of prohibitions and sanctions allows for tailored user management strategies that can adapt to various scenarios.

Note: This article has provided a comprehensive overview of how to restrict user actions with time-based sanctions using Laravel Prohibitions, detailing installation, setup, and practical use cases.

Frequently Asked Questions