-Hey, this is Michael Dyrynda. -And this is Jake Bennett. And welcome to Episode 179 of the North Meet South Web Podcast. I thought it was 180. 179, huh? Yeah. -179, okay. Well, hey- -Next- next- next week, we'll get to 180. 179 it is, folks. Um, it is post July 4th, and I'm still sort of hanging on to the mustache thing here- -It's fine -... a little bit. I can- I can... Look, the goatie, th- -the dirty goatie I can live with. -It- it's okay.
The mustache... -I'm gonna shave it all off for- for- -Maybe, maybe ... Laracon again. And now you're just gonna have to live with, uh, Jake with the mustache. Um, no, I'm not actually not gonna do that. I'm gonna- I'm gonna- I'm gonna just put it all back to how it- how it should normally be. Um, but in other news- -I was just- -We- we are actually staying at the same hotel. -I'm pretty stoked. -Yes, finally. -Finally, yes. -That- that worked out well in the end.
-It did end up working out well. -Worked out well in the end because I said back in February, like, "I've bo- bought my ticket, I've booked my -accommodation-" -Yep, yep. "... this is the closest hotel." And it ended up- ended up- ended up being one of -the- -Yeah, the conference, yeah ... the official, I guess, conference hotels. And so by the time you booked, three weeks before the event- Yeah. -You're like, "There's no rooms anywhere." -Yeah, you were like, oh-
-I wonder why, you know? -Right, yeah. And so they ended up opening -up, and, uh, yep. -1,200 people- -So- -1,200 people coming in. Yeah, so that -worked out. -It's gonna be awesome. I'm so excited. We can do, like, pillow fights middle of the night, just like- -Pillow fights. -Yep. -Yeah, yep. -Just gonna find out whose room is it. We gotta have- have so many people there. Knock on the doors and just hit people -with pillows. It's gonna be good times. -It's gonna be a bit like that. It's, um...
Yeah, I looked, 'cause I, um, I messaged Matt, Matt Stouffer, and I said, "What are we doing for coffee?" Because I know it's only three days, but I can't drink -Starbucks for three days. -Yep. -Like, that's not an option. -Yep, yep. I need good coffee. It turns out... Now, whether or not it is good is to be seen, but it turns out that in that hotel, in the Vib by Best Western, for those of you who are staying there, there is a coffee, there's, like, a cafe-
-Nice. Okay, okay -... downstairs in the hotel. So it- it has, like, a four-and-a-half star rating, so I'm hoping- -Sweet -... that that's good enough. -That'll be good. -There is also, for those of you staying there, a taqueria downstairs. So tacos and coffee, we should be sorted. Sounds amazing. Yeah, I'm- I'm really excited. It looks like a really nice hotel -as well. Um, like you said- -Mm-hmm ... it's like, I think the closest hotel to the venue of the ones that there are -on- -Yeah
-... that are on there. So, um- -Mm-hmm ... yeah, it's- it's gonna be amazing. I'm so excited. I cannot wait. I'm flying in Monday, leaving Thursday evening. So if any of you have no plans for Thursday, meaning you've stayed Wednesday, you did the afterparty on Wednesday, you slept in on Thursday, and now it's Thursday afternoon and you're looking for something to do, hit me up on Telegram. I'd love to hang out because Michael will probably be gone by then. Michael, will you be out by then?
-Yeah. -Yeah, so I'll be leaving at 5:30- -Yeah, we- we get in at, like, 3:00 -... which means I'll have a bit of time -for lunch. -Yeah. I'll be able to... I'll be free for lunch if anybody wants to hang out. -Yeah, we get in at 3:00-ish on- -Monday, yep ... Monday, Aaron and I. And then, we were supposed to leave at 6:00 or something -like that, 6:00 PM on Thursday. -Yeah. But our flight got pulled back to 11:00 AM.
-Ah. -So we're probably gonna be at the airport at, like, I don't know, 8:00, just to be safe. -Yeah. -Just who knows? Yeah, we can catch coffee. You and I can catch coffee.
Although I saw recently... Yeah, yeah, we'll be all right. We'll- the- we'll have plenty of opportunities to- to see each other over the- the three days- -For sure -... that- that we're there, but yeah, I am... I saw- I saw on the news or something, there was an article the other day that, like, tourism is way down for Australians into -the US at the moment, like 12 or 15%- -Wow, that's crazy -... on what they were expecting normally. -Yeah.
So I'm- I'm hoping that we have, like, a lo- although these- these flights that we bought were on sale, so they're sale dates, so I suspect that maybe they will be booked-booked. But it'd be nice to see if there's a bit of, uh, -bit of space on the plane actually. -Some extra legroom. Yeah, for sure. -Yeah. -I actually- -We'll see what happens -... there was a lady sitting in my seat on the last flight I was on.
And I didn't bother her 'cause, like, it doesn't matter, there's extra seats. And so I told the attendant, I was like, "Do you mind if I sit in another seat?" And she's like, "Yeah, that's fine." I said, "Why- why don't I just go sit in first class, it's like it's enough, should I sit up there?" She was like, "It's fine with me." She's like, "But let me check." And so she checked and the lady up front was like, "No". I was like, "Come on", so I just took an exit seat. It was fine.
-Ah, you tried. -I did try. She was almost, I mean, almost -had her. -You tried. -Yep. I was almost there. -Almost. Almost there. Almost got it. Yeah, we- we definitely for the long haul flights, the, uh, Sydney to Dallas and then the LA to Melbourne on the way back, we- -we went for exit seats. -Nice, there you go. -Aaron and I just- -Yeah, some extra room.
Um, and hopefully these are good exit seats because the last time I was coming back from the US, I went thinking that it'd be good to sit in the, like, the- the bulkhead row- -Yeah -... behind the- the bathrooms. -Yeah. -Terrible idea. Don't ever do that. Because -number one, the armrests- -Oh, no. Like, the armrests are fixed, so you can't move them. So I had, like... I was
uncomfortable the whole time. And you think because you're at the bulkhead, there's a bit more room, and there is physically a bit more room to stretch your legs out. But the problem is people walk past there to go- -Oh, God. -... to the bathroom from the bathroom. So yeah, no good. So we are on the... We're by the galley, um, on the exit- exit row this time, and to, like, the- the- the left of the plane.
So hopefully that'll be a better seat. But I didn't... I looked at even premium c- premium economy was like $6,000 return or something like that. -My gosh. -I said, "Nah. Not." -Hey, okay, I've got one- -No thank you, not for me ... one quick tip for you here -for sleeping on planes. -Mm-hmm. Okay? There is this amazing product called the Sleeper Hold. -Sleeper Hold. Is- -Right. -No, seriously. It was invented by an- -Nonsense -... an MMA guy, a UFC fighter- -Mm-hmm
... who had to go on flights and trips and stuff like that all the time. And he was, like, sick of, like, not being able to sleep well on these- on these trips. -Mm-hmm. -So he invented this thing called the Sleeper Hold. Now, I got one at a conference. I was like, "What is this nonsense?"Oh, my gosh. I will never travel without it again. It is amazing, and you can actually sleep well on flights or on buses or on- -Right -... on anything like that- ... that has,
like a rest... Like, a seat behind you. It is incredible. So if you... I mean, because you're gonna be on these insane flights, you know, you're gonna be hitting 14 and a half hour time difference jet lag thing, I would suggest snapping one of these up. Now, they're not inexpensive, but they are amazing, amazing. And so, um, check it out. Sleeper- Oh, the travel pillow. Right, right, right, right.
Sleeper Hold. Yeah, yeah. It's a s- it's a no- -When you say sleeper hold- -And I know, and I know, it's- it's not, -you know, it's not just a travel pillow. -Yeah. -It's- it's- it's a little bit different. -Yeah, yeah, yeah. They've got some really good marketing as well, but I've actually used it and the marketing holds up. The hype holds up. It's really good. So for any of you listening who are gonna be going to Laracon, grab a Sleeper Hold. Tell them
Jake sent you, there's no referral code or anything. Sorry, otherwise I would give it to you. But, uh, they're pretty sweet. Pretty sweet. So... Right. So this thing, you strap to the... You strap to the seat, and it kind of holds your head so your face doesn't flop forward. That's right. Yeah, so you have a little neck thing that- -Yeah, cool -... goes behind, just behind the- the, like, the little dip in your neck, in the back of your neck. You just put the pillow -there- -Mm-hmm
... and then there is a strap that goes around the back of the seat. And then there's like a eye mask that kind of goes over the front of your eyes and holds your head in place up against the back of the seat. And you don't, you know- -Yeah, right -... those neck cushions, they don't actually hold your head up, so you- you kind of, you have to try- -Yeah, yeah, yeah -... lean your head back. It doesn't work very well. This works amazingly, and I have slept like a baby on flights with
-this thing. So, highly suggest it. -I'm, uh... I have sent this to my wife. -Mm-hmm. -I am very fortunate in that I, generally speaking, on a flight, will close my eyes and wake up eight or nine hours later. -That's amazing. -Especially on the way back. Especially on the way back, because it'll be, you know, three days of go, go, go. We've got the- the mostly technical party on Monday night.
-Yep, Monday night. -We've got after dark on- on Tuesday night, then there's like... I assume we'll do something on- -Wednesday night, yeah. Did you- -... on Wednesday night as well, and then -we're gonna be up- -There's a link, I'll send it to you. -There's a Luma something. -Yeah, yeah, yeah. I- -You get that one? -Yes, that was for Tuesday night, I think, -that one. Yeah, I got that one s- -I think that was- -So, did that, um... -I thought that- I thought that was for Wednesday. Let me look.
-Luma after party. -Can you double check? Yep, I'm looking right now. Tuesday. You're right, it is Tuesday. Yep. -Mm-hmm. -My bad. Yeah. Yeah, so, um, that, and then Wednesday night, I assume we'll do something. Go -grab dinner or something- -Yeah, yeah ... with the- with the guys. Anyone who's- who's keen for that. -For sure. -Um, and then Wednesday we'll be up early, and then we're just gonna have to try and power through LA. Um, Aaron and I are
gonna go and do the unthinkable. And I don't know if we're actually gonna do this, but I- I joked to Aaron, I said, "So, outside of LAX, there's a Five Guys, -an In-N-Out, and a Chick-fil-A." -Gotta do it. And I'm like, "We'll just eat all of them. We'll just do all three." You gotta do it. And then, uh, yeah. So by the time I get on that plane, and- and this has happened every time I've left the US for- for any trip that I've been over there, I'm asleep before wheels up. Like,
before we leave the ground- ... my eyes are shut. I'm out. Yeah. -Oh, my gosh. -And they come- they come at like an hour or- or- or two later, and they're like, "Do you want dinner?" I'm like, "It's midnight. I don't- I don't want dinner. Go away." -That's funny. -"Why did you wake me up for this?" So... -That's hilarious. -This light- this light keeps on flicking off and on for some reason, I don't know why. So every now and then I get shrouded in darkness. -Well- -So yeah, Laracon, uh, this-
Anyway, long story short. Yeah, absolutely ... this will be our last- last North Meet South before Laracon. Uh, we've got... We'll do an episode of Laravel News next week. Mm-hmm. And then we'll be on location. Is it that quick? No. Oh, no. We will have one more North Meet South before Laracon. Okay. Okay. And then we'll be on location. Yep, yep, yep, yep, yep. So yeah. A- and then for Laravel News, you and I will be, uh, running around. You did a day one recap last year with-
-Yes -... David Hemphill. -Yes. -Which made- made me feel very slighted, -uh, that you would- -I'm so sorry. ... you would do something like- like that . I think I mentioned you. I thought I mentioned you. -You did- you did mention me. -Okay. But, uh, you know, I will- I will- I'll be there this time, so you watch yourself. And so it will definitely be you and me. Yeah, Hemphill. Watch it, you're gonna -get- you're gonna get a- -So yeah, we'll do-
-... shiv. -We'll do a recap day one and we'll do day two, 'cause there was no day two last year. -Right. -Um, and I think we're gonna go around and -do some like vox pops- -Absolutely ... and speak to people and- and talk to them as well for Laravel News, so that'll be a bit of fun. Something- something to do. -Should be a good time. -So if- if you are interested in doing that, keep an eye out for us. We'll- we'd love to talk to you about what you think. I saw Taylor's got like a two-hour
-keynote at the end of day one. -Wow. So that'll be- that'll be a bit of fun. And looks like there's a lot of variety in the talks as well. If you've- if you've seen the schedule, there's some- there's some, um, you know, 30-minute talks, 20-minute talks. They're all over the place this year, which- which is good. I think- I think mixing things up like that is- is good for the audience as well. Um, getting a- a mix of lengths and types and-
and all sorts. So -very excited to get back over there- -Yeah ... after, what, six years or whatever it's been. Yep. It's gonna be incredible to have you, dude. It's been too long. Too long since we've been able to hang out in- in, uh, the real, right? In 3D. -Mm-hmm. -So it'll be fun. It'll be lots of fun. Hey folks, we have a couple different topics that I would like to talk about today. The first one is this. Should you have
a middleware call inside the constructor of a controller? Okay, so set it up for you. This is something that used to be supported and I do not think it's supported anymore in Laravel 12, which is this. Inside of a controller you can, in the constructor, say, "This middleware," and then specify a middleware. And what this will do is this will apply that middleware to anything that you're going to be accessing that controller
through, right? Any route that references anything that points to that controller, you can have a middleware in the constructor of that controller. Okay. Are you ready? Think about it for a second. Make up your mind. Do you think you should put it there or not? And go. All right, what do you think, Michael?
No. And you, you, you posted this the other day- -I did -... in Telegram, and I- I'm gonna grab a water while you formulate your response and, and tell me why I shouldn't do it, so then I can actually come back and tell you why I think you should. But go ahead. Yeah. I mean, Laravel 12, you said you can't do it, so that's, that's as good a reason as any to not do it. Um, I know
there used to be some explicit reason to do it. Like, you... There was some part of the request lifecycle that wasn't available inside of your route definitions, which is why you, you maybe wouldn't have done it previously. Like, you wanted to dynamically apply a middleware or something like that inside of the controller constructor. The, the reason I don't like the idea of putting the middleware in the controller is kind of similar to why I don't like using, um,
events too much. I don't particularly like using observers and, and global scopes, although those things are a little bit more -opaque now- -Yeah, for sure they are ... because we've got the attributes to say, like, observed by, scoped by, and all of that kind of stuff. But I feel like the routes file is the first place that I'm going to look in a new application to see everything that's happening across the application. Like, I know what
functionality is available, I know where to reach it. It's a very quick and easy way. W- this is the same reason I don't like route definitions inside of controllers using attributes, which is a thing that has- -Fair enough -... like, come and gone in the past.
Because if you want to s- I mean, you can always do a route list and see the route list that way, but I think opening up the routes file and just scrolling through it and seeing everything that's there is my preferred method for, for dealing with that kind of stuff. When you start putting things in- inside a constructor, it's, it becomes less visible. Um, it... Like, does it still appear in the route list if you d- define a -middleware there? -That's a good question. I honestly don't
-know. -'Cause that would be my hesitation. -I'm not sure. -Yeah. 'Cause that would be, that would be -another hesitation of mine- -I kinda feel like it wouldn't -... is that you don't know. -I kinda feel like it would not. Yeah. Yeah. Um, so yeah, my, eh, I never, I never do. Um, all of my middlewares are defined inside of -the routes file. Yeah. -Fair enough. Now that being said, uh, I mean there are multiple other places where there are middlewares being placed onto
things without your knowledge or just explicitly by the framework. So, you know, one of those places is in the bootstrap, uh, app.php file, where you're- -Mm-hmm -... setting up all your routes and all those things. And if you use a then, uh, portion of the section there when you're defining those different routes, then you can apply middlewares there and things like that. You know, you can set up a new stack essentially. You have web, you have
API, you have console, which are all getting set up. You have up, which is also another one that ships by default with Laravel 11. But if you have a then, you know, you might do something like development routes. Like, if you're in development, you will, then you'd bind these development routes, and you could put, uh, prefixes or middlewares on it in there.
Uh, there was previously in, you know, previous versions where you had a, a route service provider or something like that, or the HTTP kernel, you could do things in -there as well when you'd register those- -Mm-hmm ... or when you'd bind those sorts of things. And so, it's not like it's only ever been that the routes file is the only place where middlewares are applied. I -mean, there's a web- -Right. There's a web stack that's applied by default.
-Yeah, yeah. -So I get the argument that, like, if you can just go see the web.php, you can see everything on there, but it's not actually true. Like, there's... That's all the -things- -Mm-hmm ... that you would put on there, but it's definitely not all- -Yeah -... the things that are on there. -Yeah. -So, um, I would say that, like, as far as the user definitions are defined, I agree that the web.php is where you would go see
all the user-defined things most of the time. Um, you do have to be a little bit careful if you're migrating from legacy applications, and that's the situation here. That's why we ran into this, is we've... You know, we've been on this since Laravel 4, and so this very particular application has been upgraded to 4, 5, 6, 7, 8, 9, 10, 11, 12. And so, 12- -Yeah -... is when it sort of- -Yeah -... dropped support for it and caused some
issues for us. The one thing I will say that is helpful, and maybe the reason why, um, what you were talking about, is like if you wanted to resolve something out of the constructor in order to be able to apply that to a middleware or s- pass that in as something to the middleware, it's possible that at one point that was not available. But obviously now you can make your own middleware classes and things
like that, so it's not a problem. Um, but if there is a middleware that you want to apply to every single method inside of that controller, it is possible for someone to miss that when they're defining a new route for that controller, right? Maybe they don't look and see the other places. Maybe that control... Maybe the, the locations where, uh, those are defined are not co-located. Maybe they're just adding a new one to the bottom of the list and they don't go
find it. That controller middleware, uh, is not gonna be applied now. And so, that could be problematic. Now, that's... Maybe there's ways around that. Maybe you can put an architecture test in place. But that was the particular argument that I had, which was like, it's not necessarily all bad to be able to define it in the controller. I can see the arguments for why you maybe wouldn't, -but I don't think it's- -Mm-hmm ... I don't think it's that bad. I don't know. I don't know. Yeah.
I'm just trying to look back on when, when it was actually... 'Cause there's nothing in the Laravel 12 upgrade guide that I can see that's obvious that says this has been removed. So... -All I know is it was throwing an error. -Controller middleware. -Yeah. -Oh no, it's still here. -It was throwing an error. -Controller middleware. -Go ahead. Yeah, maybe just- -Ouch
-... maybe the way that we defined it. -Oh, you put it... Yeah. So used to be in a, um, cons- in the construct method, and now you can define it as a stat- a public static method that returns an array inside the controller. I got it. -So it's still able to be used- -And you, and you implement the has -middleware -... just not in the same way. Oh, I see. I -see. -Mm-hmm. Yep. Just not in the same way. Okay. Fair enough.
Fair enough. Middleware may be assigned to the controller's routes in your routes file. You may find it convenient to specify middleware within your controller class. To do so, your controller should implement the HasMiddleware interface,
which dictates that the controller should have a static middleware method. From this method, you may return an array of middleware that should be applied to the controller's actions, and you may also define ControllerMiddleware as closures- -Hmm, interesting -... which provides a convenient way to define an inline middleware without writing an entire middleware class. But it doesn't, doesn't really say why or when you would do this- -Sharp knives -... which I guess is... You know, sharp
knives, right? Laravel provides many ways to do the same thing. I would, I would posit that doing it inside of the controller is potentially a less, um, what's the word? Like, a less conventional way of doing it. -I agree. I do agree with that. -But, you know, it's documented. Um, yeah. I don- I mean, yeah, i- for... I wouldn't do it in the controller for the same reason that I wouldn't, that I don't subscribe to, to doing route definitions inside of the controller. -And that's fair. -Um...
I, I do get that. Yeah, and, and so it sounds like it's not necessarily... Th- the method by which we were using it is deprecated, but the, the idea itself- -Mm-hmm -... is still very much documented and relevant inside of Laravel. So, fair enough. I, I think that's, uh... You know, it's again, sharp knives, use them if you want to, uh, if you don't... If you cut -yourself- -Yeah ... don't complain, right? Just deal with it. So... Yeah. It's certainly like a top level documentation item.
-Yeah. -Right? It's in, on this page, introduction, writing controllers, controller middleware. So it's not hidden. It's not one of those things that, like, gets pushed down the documentation until one day it disappears and then you know that it's... It, it likely won't ever be removed.
Eh, in, you know, the way that Laravel typically handles deprecations, is just that at some point it's determined to be not the best practice or, you know, there's another way of doing it that's, that's more appropriate or more, uh, efficient or whatever else. And so the documented approach becomes the way to do things, and stuff that drops out might get deprecated eventually, you know, in two or three major releases time. But,
um, it typically survives even though it's not documented. So it's still, still there as a top level thing. But yeah, I don't, I don't see where this... I, I'd have to dig to find out, you know, why you would do it in a constructor. Like, what, what was the documented reason -for doing it- -Yeah -... essentially? -Yeah. I, I don't even know if I could tell
you in this case. I, I think it... This one is honestly just... It was like a authorization check to see if somebody had a particular role or something like that, -that's all it was. -Mm-hmm. Mm-hmm. Like, "Can they do this particular thing?" If they can't do this particular thing, then there's no reason for them to see the view, the update, the create, the delete. Th- they shouldn't be able to do any of that stuff, like, don't bother even- -Right -... doing a policy on it. There was...
This was before policies were a thing. You just said, "At the controller level, don't bother, just abort. Before they ever do anything with it, just abort." Which brings me to my next question. Um, unless you have anything else you wanna talk about, which I... So, I've got -one more thing and that's- -No, no, go for it. -Okay. Okay. -Are you... You meant, you, you, you floated this, like you got in early with this one, so you've... It's obviously on -your mind- -It is
-... so let's talk about- -Yes. Okay. So we talked about this with the other devs on the team earlier today. Okay. So I'm gonna try and set up the world for you a little bit and then we can chat. And I think you can help me point out maybe some p- some potential flaws, or maybe not flaws but pitfalls that I might be looking into or that I might need to investigate and/or better ways to structure this. Okay, so here it is.
-Mm-hmm. -Let's say I have 20 apps, which I do, and let's say that each of those applications has, currently has their own roles. And the way that we're checking permissions or abilities inside of any of these locations and inside of any of these applications is only through checking of
if a user has a role. Okay? So that is, that is the way that we've done it. Now, the problem with that is that the onl- if you only define roles, the only way to give somebody permission to do something is to assign them a role. Does this make sense? -So- -Mm-hmm. Yep ... if you have a person, let's say that there's a manager who's stepping out for a week and they have a person on their team who's like their number two, right,
assistant to the regional manager if you will. And they need this , they need this user to sort of take their place, interim, uh, manager, uh, for a week. The only way, i- but they really only need them to do one part of their job, which is that they need to run this report every day and send it to the CEO. Let's say that's the -deal. -Yeah. Right? That's it. That's all they need to do.
But because the only way to give them that permission is to assign them that role, in addition to getting the ability to run the report, they also get the ability to put in coaching entries or reprimand other peop- or s- read entries for other teams', um, employees or team members that are on that team, right? Not what you're -asking for, not what you're looking for. -No.
Certainly, like, not a least privileged situation. And so what we're running into is that we have people who have permissions that they should never have just because they were given them temporarily and then they were never removed. Right? So the only way that we can catch this is if we do these audits, which we end up doing, but it's a big pain in the neck. And there are ways, there
are better ways to do this. So, I'm gonna ex- I'll explain to you sort of our proposition and then I'll continue to kinda go through how we wanna manage it. The proposition is in any place where we have a HasRoleCheck, we're gonna remove that HasRoleCheck and we're going to name the thing that they're trying to do at that check. So, instead of
HasRole, we're going to s- HasRoleManager, we're gonna say CanRunReports. In that spot, that one spot where they check to see if they ha- if they're a manager. Instead we're going to say name that thing that they're trying to do, they're trying to run a report, and then we're going to ask the question User CanRunReports. Right? Okay. So we're going to change it from a role to a permission or ability. Permission and ability are the same word, essentially. Which do you prefer?
Mm-hmm. I I think the, the general advice, like the 90%, 95% use case, is to assign -roles and check permissions. -Okay. Permissions. It's certainly the way that, that we operate, is that we will always check that -the user can do something. -Yeah. Okay. We would never... Well, I say never. In our modern stuff , in our new stuff, it's always a permission check. Okay. Uh, or a policy check or whatever else. Previously, in our old code, it w- it was
-base... Like, we would assign roles. -Yeah. Yeah. We had a permissions table, but p- but permissions were never implemented, so it was always like, "Is... Does this user have a role?" -Yeah. -We would always check are they an admin, -are they a manager. -Yep. Are they a group manager. We had, um... And, and like you say, that then means that that person has access to everything that that role enables them, um, whereas you want, typically, I think, your permissions to be as granular as possible.
Yes. The... Yes, correct. I agree with all of that. Um, my question specifically is, when we're talking about that, you're using the word permissions to talk about a granular level thing that they can do. Another word that I've heard used for that -is ability. So, my question is- -Mm-hmm ... for the remainder of our discussion, would you prefer me call them permissions or abilities? It depends on what you... If you're just using Lyro stuff, I'd call them
-permissions. -Okay. So, yeah, permissions. And that's -what my guys sort of said too. They said- -And you- ... "Oh, we like to call them permissions instead of abilities." 'Cause I've called -them abilities- -Yeah ... in the past, and I th- we can call them- -Yeah -... permissions. That's fine. -It's a bit... Like, I think bouncer? -Yes. 'Cause I know you've used bouncer in the past. Well that, well that's because of abilities. Bouncer refers to the roles and abilities.
-Yeah. Yeah. -Yeah, right. Um, I think... How would you -think about this? -And then there are no permissions, we're first giving out permissions. Yeah. Like, you have permission to do something, but you have the ability to -enact that, that something, right? -Yeah. Yeah. So, I think it depends on which way you're looking at... You know, is the user the one that... You know, does the user have the ability to do this thing? -It- -I know. They're, they're synonymous.
-The user has the ability- -They're synonymous. Yeah. Or does the user have the permission? Yeah. Yeah. And so, I'm just trying to establish, like, uh, the domain language for our team, like, whether we're gonna be using the word ability, permission. I've -used the word ability- -Yeah ... but I think we're switching over to using the word permission.
Sounds like if the rest of your... Yeah, I was gonna say, it sounds like if the rest -of your team- -Yeah -... is using permission- -Yeah, that's the word that they would like -to use -... then, then you're using permission. -Agreed. -Um, and like I said, I, I think the, the fact that ability is in your head is probably owing to the fact that you used- -100% -... that you've used bouncer in the past -as well. -Yes, it is. But, like, the Sparcy, Sparcy has a permissions package.
-Yeah. -I think generally when people speak about -it, it's permission rather than... Yeah. -Yeah. Okay. So, we've got permissions, right? In every spot where we're doing the HasRole, we're going to check, uh... Instead of HasRole, we're gonna say HasPermission essentially. Think about it that way, right? So, we're gonna make everything very granular, and
so our application will check for permissions. Now, the second part of this is imagine that across those 20 apps, you know, every app has its own set of permissions that, that are a part of that, right? -Now- -Mm-hmm ... who manages those permissions is the question. Who gets to manage those? Well, I will tell you, my preference is that I never ever manage those. I want my team to write the code that enables people who have that permission to do that thing.
-That's what I want my team to do. -Mm-hmm. But I do not want my team to manage permissions. I want the IT staff to do that. -Um- -Right ... and for them, even only in a limited capacity. So, um, what I would like to have happen then is if you can think of a different application... So you have these 20 applications that live on the bottom level there, and all those le- all those are doing is they're checking for abilities. So, there is essentially no,
no concept of roles anymore in those. We're gonna rip those out of that application. No roles anymore. It's just permission checks. We're gonna go up a layer, and now you're gonna have an application, uh, one layer above that knows about all the different applications and then knows about all the different roles in those applications, and then groups together different permissions for those particular roles.
-Mm-hmm. -Does that make sense? Now, that application that sits above that is active directory, essentially, is the idea, -right? -It's exactly what that is. Yeah. I mean, that's what it is. And so, and so what we're thinking is, like, why reinvent the wheel on that? E- essentially what we do is we have a user, and that user will have a job function, which is essentially their job title,
right? So if I have a banking manager, um, that banking manager is going to have specific permissions inside of each of those 20 different applications, right? Inside of some of those applications, they may have a role of manager. So, like in the case of, like, coaching, right? -Mm-hmm. -Because they're a manager, they're going to have likely a coaching manager role inside that application, but the
application doesn't know anything about that. All it knows about at the end of the day is which permissions that user was granted when they come in. The way that this will be structured then in Active Directory is you will have a coaching_, so it's actually namespaced in Active Directory. App_coaching, which is the name of the app, _role or ability. So, app_coaching_manager. That's the role, right?
-Mm-hmm. Mm-hmm. -And then nested underneath that would be additional security groups that would apply to that particular role, right? So app_coaching can add new coaching log. App_coaching- -Yep -... can run coaching reports. And those abilities may only live under app coaching manager, but they also may run under... May live under app coaching admin.Right? So those abilities have basically a one-to-many relationship between- -Mm-hmm -... those, uh, those different security
groups. Okay? And then each user would get assigned to one of those security roles. Okay. The reason why that's all important is because when a user is created in the system, they will get a single set of roles. That's it, that's what they get. They get the ones that belong to their particular job function and nothing else.
-So if- -Mm-hmm ... that user that was previously mentioned needs to take over for their manager for a week to run that report, instead of giving them app_coaching_runreport, or sorry, a- app_coaching_manager, they would get the ability of app_coaching_cannrunreport. They would get that single ability rather than the manager role. Now here's the really interesting thing.
We are going to say that anybody who needs an additional permission outside of the ones that apply to their specific role, they only get a lease on that permission. -Yeah. -Does that make sense? So it's- -Yep -... expiring, meaning that they can ask for it for a period of time, and then after that, it goes away. It gets removed- Yeah -... from their user- -Yeah ... so that we don't end up with this mess of what we're talking about, where a user
gets a permission and it just is signed forever. So you have somebody who started in one team and they've moved three times, and now they have inherited permissions for every single team they've ever been on. -Yeah. Mm-hmm. -Which is a freaking disaster mess. -Um- -Yeah ... and it's really unclear what they actually still need and what they don't -because they were never removed. -Mm-hmm. -Yeah. -And so that's the big picture of what we're trying to- -So- -... accomplish. Yeah.
Mm-hmm. So are these, the expiring permissions, are they being managed inside of Active Directory, or are you doing that, like some scheduled task that goes through and, and cleans up these permissions where expiry date is in the -past? -Yeah, you got it. And so it's actually a little bit silly. We're using AD LDAP, so Active Directory- -Mm-hmm -... L- LDAP. What is, uh, listing
directory? I don't know. It's, like, that protocol basically that lets you- -Yeah, yeah, yeah -... talk to those things. -Yeah. -And what we do is when somebody wants an additional permission, we can say, "Okay, they want..." You know, select the application you're trying to get permissions for. Coaching. "All right, here are all the ab- roles and the abilities that are available for you to lease." "Okay, I want to be able to run the report." "Okay. When does it, when
does it expire?" "It expires in, in a week." And then they say, "Okay, request." Their manager has to look at it, approve it, and once their manager approves it, it will then send that off to our auth application, and then that thing actually adds that, uh, group... -Uh, sorry, adds that user- -Mm-hmm -... sorry, to that group. -Yeah. And then it will, you know, check the end date every day at 7:00 AM, and when the end day
hits, it will remove that user from that group. And then when they log in the next time, it will look at the AD groups that they are a part of and it will remove the ability that they previously had, uh, when they logged in- -Right -... last time.
-Mm-hmm. -So that's the idea. Now the, the big challenges that I'm running into here is that this top level app, uh, that's going to help manage all these things has to be aware of all the different mappings that I have for these abilities inside of all these different -applications, which is- -Yeah ... that is the pain, but I don't really know of a better way to do it if I don't -want- -Yeah ... my team to manage it.
Yeah. And it also means that anytime you add a permission somewhere, you've gotta do it in two places. -Yes, correct. -You've gotta do it in the app, and you've -gotta do it in the- -Active Directory -... the overseer- -Yeah -... as well. -Yeah. Yeah. But yeah, I mean, and, and expiring permission is a good way to, to deal with it, I think, especially from a compliance perspective. -Yeah, exactly. -You know, no one should have access to things that they shouldn't have access to, so having that-
-And we can see when they requested it -... That's amazing. And it's like... Yeah. Yeah, if you're keeping audit trail of it, that's, that's gonna be helpful for that kind of stuff as well, 'cause you know that no one's got access to anything that they shouldn't. And if they do, you know, they shouldn't typically have access to it. You know when they requested it, when it was approved, by who, and when it
was removed. And, um, yeah, I mean, it's no different to how when you create GitHub tokens and things like that, you can request for it to be, you know, seven days or 30 days or 90 days or, or, or unlimited. And as much as it annoys me every 30 days to have to, to -roll a token- -I know, right ... I think probably having a, a 30 day token is, is still the, the correct answer for most things. -Yeah, there's, um, the- -Spreaker. Spreaker on the pitch. Yeah. Oh, he's ...
He- he's got his, uh, he's got his pajamas on. Harrison, you wanna say hi real quick? Come here. Come here. Yeah, that's fine. -The baby of the bunch. -Har- come say hi here. Hold on. Hold on. Let me put your head phone. -Look at him. -Say, say hey, Michael. Hi, Michael. So big. Hey, man. How you doing? He's s- -He's doing good. -I remember the, the last time I saw him was teeny tiny in a pram in New York. -That's how long ago that was. -Oh, that's right. Dude, that was Laracon.
-No, look at him. -Harrison, you were in Laracon. -Yeah. -You were at Laracon with us at eight weeks old, remember? You don't remember. -I don't remember. -No, he don't remember. All right, say, say, "Hello world." Say it l- nice and loud to everybody. Hello world. -There he is. -I love the eye roll. Sorry. Sorry. Bye, Harry. Um, so, uh, yeah, what was the last thing I was gonna s- oh, here's the other piece of this which is really interesting, I think.
Um, if, so when a permission is about to expire, we can send an email out and say, "Hey, you have this permission which is about to expire. If you need to extend your lease -on it- -Mm-hmm ... you can request, uh, an extension here." And they could click it. It could -fire- -Yeah ... off that extension request, and then their manager could approve it again, and
then it could happen. Right. So I think it re- and so what that allows essentially, is that allows me to not only actually remove the burden from my software development team, it actually also removes the ability of my IT guys to get involved. They'll have to add new permissions- -Mm-hmm -... but they should never really have to get involved in the modifying of permissions outside of- -Yeah -... if we need to add a default permission
to a particular job function or job role. Right? Um...So it'll be a little bit of like a hand in glove situation where we do need to work closely with them on some of those things. But as it is right now, it's sort of a pain the neck because they'll have to message one of the software devs and be like, "Hey, somebody said they need to run that report. What role do they need?" That's, that's... 'Cause there's, it's not transparent to them at all- -Yeah -... what, what roles are needed for what
particular abilities. And so it's just we're trading problems, and I think it's a better solution. Yeah. -So. -So two, two things that I just thought of. Number one, um, how easy are you making it? So if I have to go and request permission to do some report, is it fairly obvious that I'm like, "This is the permission that I want"? -Right. Like- -Are you naming them in such a way? 'Cause- Yeah ... most, most permission stuff would be transparent to... I mean, maybe managers
know what the permissions are. You know, there would be some level of knowledge there depending on their technical skill. But for most, most workers, I would imagine that they don't know what they're asking for. That's agreed. That- that's true. And I think right now, it's completely obli- n- -nobody knows. There's no good catalog- -Yeah ... of abilities, right? And so what we would have to do as part of this is we'd
have to... You know, we'd give it a good name, and we've got a convention that we're using to convert the abilities, um, to good named AD security objects. And then we need to give good definitions to them as well. A- and so that'll be part of- -Yeah -... the process of converting these over,
is just making sure that we give good descriptions of what they are. And then we'll probably have to do something like a package, honestly, something that's going to help to coordinate the different abilities between the different applications. Or we'll have to create an endpoint that lives on these applications where they can be hit and queried, and then they can return back those, those pieces of data. 'Cause I really don't wanna have to update...
I- I don't wanna have to update a package every time I wanna add a new ability. I -don't wanna have to do that. And so- -Right ... I think if we just created an endpoint that was like, "Hey, give me all the different ability. Give me, give me your permissions catalog," and it could, it could say what those are, then we can just essentially advertise that and, you know, use an API token, go grab the abilities, uh, the abilities catalog, and then, um,
push those into a config item or something like that. You know what I mean? I'm not -using the- -Yeah -... right wording here, but that- -Yeah ... that would be the idea. So yeah, that, I think- -Yeah -... that would be how you'd do it. You would try and make it as obvious as we could. So that was, that was number one. Yeah.
-And you had number two. -Um, I think the, the other thing, the other thing was, you know, if, if you needed to request an extension... I mean, you, you said at the top that people would be asking for permission to do something because their manager is -going to be away. So if they need- -Ah ... to extend that, who's, who's approving that? -Yeah, no. -Because the manager's obviously, you know, -away for a bit longer, so there's- -That's a good-
-... that's something to consider as well. -That's a good question. Um- Like, someone would have to approve it, -um- -Yeah ... and they would probably... Like, I would, I would say that that is more the exception than the norm, where maybe, you know, your team or IT would have to step -in and go- -Yes ... "Well, they had it." Yeah, typically, that, that has happened before. -But then you'd have- -Yeah, where, where we would have somebody -who's away- -And I think you would probably have some
-rules around that as well. -Yeah. Like, you can only request one extension, or the extension can only be for two days -or something like that. -Yeah. And we did a, we did a similar kind of thing with, um, like invoices. When you've got an overdue invoice, you can request an extension. And so the, the frontline staff would have permission to request an
extension, and there'd be, there was a series of rules. Like, you could, you could ask for s- uh, 14 days or seven days, but you could only ask for each once. So initially, you'd get like a 14-day buffer. And then if you had already asked for 14 days, you could only ask for a seven-day extension from there. And then there was like... that was it. And that was, like, enforcing business rules ar- around those kinds of things. Because there's also this expectation of,
um... This was in telecommunications, so there's, there's a whole code of practice around, um, not l- allowing customers to get, you know, dig themselves into debt- -Yeah, yeah -... over these kinds of things that, you know, you would have to, you'd have to cut them off. You wouldn't be able to keep extending them so that you didn't keep charging them for a service that they -clearly can't pay for or- -Yeah
... or had no interest in paying for. So, um, yeah, maybe something like that where, you know, you get one, one, um, bump. You know, it gives you an extra three days or something. And then beyond that, you have to ask for a whole new thing. -Yeah. -Um, that, you know... Yeah, w- what that looks like for, for your organization and, and how you implement that or what the, what the business rules around that is, you know, up to, up to you guys. But it might be one approach that, that could be
-suitable. -It's a good idea to have a maximum number of, um, extensions that you could do though. I think that's a great idea. It's -not something- -Right ... I'd thought of before. 'Cause yeah, otherwise you could just have somebody continue to request extensions and just kind of go that way. And- -Mm-hmm -... that does defeat the purpose a little bit, especially if we have, like, long-term leases.
You could ask for a new... Yeah, but you could, you could ask for a new- -Correct -... extension. -Yes. Absolutely. Yeah, you- -But it would, like, you couldn't just, you couldn't have like a seven-day extension for the time that manager's away, and then you would just ask for like... I would just top that up for another three days, -another three days- -Yeah ... another three days. Like, you would wanna set a cap on that.
-Yeah. -But if they, there was genuinely a need for it, you know, if the manager had delegated the responsibility of running that report to someone else, then, you know, that would just have to request that -permission, you know- -Absolutely -... and say, "Okay, yes-" -And we have, I think the solution- "... let's do it again. Here's another seven days or here's 30 days now." Yeah, the solution in that instance would be like these long-term leases that we -would have, that would be like- -Mm-hmm
... you could request up to like a six-month lease or something like that. If -you're- -Yeah ... if, you know, in some instances, maybe it'd go through an additional approval process or something where it's like, "Why are you asking for a six-month approval?" Mm-hmm. Uh, you have to have the approval of two... Or sorry, a six-month lease, you
have to have the approval of two people in order to get that or something. Um, and if it was gonna be made a more permanent part of a role or delegated to somebody else, then we might need to make an additional layer, an initial role, like a training, uh, assistant. You know what I mean? Something like that role. And then they just get that ability as well. Um, but again, the nice thing about this is that if we needed to make that role, we would not have to be involved with that at
all. That decision can be made higher up the chain- -Mm-hmm -... and we just check for the ability. -Yeah. -So it's really nice. -Yeah. -It allows the IT teams- -Yeah. The roles can be created whenever. -You got it. Yeah, roles can be created whenever, as long as they're composed of existing -permissions. -You got it exactly right. And so I think
that really frees them up to do a lot of work. Now-... um, the, the trick is naming the abilities well, and then the second trick is making sure that they kinda stay in sync across this, uh, orchestrating, uh, entity that, th- that sits above it. And so... That's it. That's it, but I, I think, I think that works. Um, and I think we actually might be able to get away without using permissions or
bouncer, Laravel permissions or bouncer, actually. Because we already have... -Mm-hmm -... a process by which when a user logs in, we look at all the security groups they're a part of, and we can inspect that and assign permissions, uh, it's basically just an array. It's just an array of permissions- -Yeah -... which would be an enum cast of, you know, w- of AD groups, AD security groups mapped to named permissions. And we'll just cast them to an enum on that user and that's it.
-Yeah. -There's no, there's no need for, like, -this one- -Yeah, I think- ... to many whatever, because we're not gonna do roles inside of the application. Right. Yeah. I think if, if the permissions for your application are coming from something like Active Directory, then there's, there's no need to -layer the package on top. -Agreed.
As long as you've got some way of translating those things into... You know, I mean, you could d- dynamically register policies or whatever else, or, or gates -and things like that- -Mm-hmm ... based on this. And then, whether you cache that, you know, for 24 hours, do you cache that just for the request, like do you use- -It's... Yeah, just for the session -... it once or whatever? -Yeah, it's just... Yep. -Yeah.
Yeah, and when they log in again, it does the check again. So it, it goes and talks to AD and says give me the list of, uh, security groups they have. -So you're not- -Yeah. So how are you, how are you dealing with, like, changing in permissions if, if -someone like- -Doesn't log in? -... has a permission unassigned- -Yeah, right -... while, like, during a session? -This is a good question. And, and this is- Are you-
I don't have a good solution to this. This is a good, this is a good question to ask. So, wh- what I will say is like right now, and the way that they've had to do it, like if they've had to add a permission is they'll add the permission and then they'll ask the user to sign out and sign back in, right? They sign out, they sign back in, when they sign back in- -Yeah. Yeah, adding, adding is fine. -Yep.
Because someone, because someone wants that, I want extra things- -Yes -... yeah, I'll do, do the work to sign out -and sign back in. -Exactly. Now, the question is- -But if you are having some permission- -... do we revoke that? -... revoked. -Yeah. Yeah. -Yeah. -Now, the way that we've got it set up -right now- -Or, or if, or if it's a lease that it -expires- -Yeah ... like it's gonna have to log you out somehow. Yeah, so the way that we do it right now is, yeah, the thought is that we expire
the lease at like 6:00 AM. So at 6:00 AM on that day we say it should expire this day, we revoke it. And if they haven't logged in that day, which it's very unlikely that they have, then when they log in that day- -Mm-hmm -... the permission will be revoked. Now, in some weird case where we needed to revoke a permission for somebody in the middle of the day, which I, I don't really see that happening. We don't typically get requests to take permissions away. We get plenty of requests to add
permissions, but almost never. The only case I can think of where we say like we would revoke permissions would be when somebody's getting terminated. -You know, that happens. -Mm-hmm. -But typically the way that that works is- -Yeah ... a manager will set a time to say, "Hey, at 1:00 we're gonna have the
conversation with this person, we need to terminate this user at 1:00." And so they'll pull them in, the IT team schedules the termination for 1:00, they then revoke that user's access and then by the time they get back to their machine, it's locked and they can't get logged back in and it's fine. So- Yeah. I don't... It's, it's a, it's an interesting question to posit but I'm not sure that it's a critical component of what I'm hoping to accomplish. I, I don't- -Yeah. -I don't know.
Yeah. And, and I assume in an organization like yours you'd have a risk register somewhere, and these are the kind of questions that I sit there and I come up with and I send it to the risk team, and they put it in the risk register and we say, "Okay, we know about this but we don't care about it." -Yeah, exactly. -And as long as it's in the risk register- -Yes -... you know, it has been raised, it is, you know, we've decided that it's not something that we're terribly concerned
-with, fine, but it's been noted. -Exactly. We mark it as an acceptable risk. And it's better to have something on the -risk register- -Yes. Yeah, right, yeah, yeah. And it's better, for those of you listening who are in, in smaller organizations or you're, you know, on your own or whatever,
it's probably fine, you don't have to worry about it. But in, in big organizations especially those that are, you know, ISO 27001 or their SOC 1, SOC 2, whatever else, these are the kinds of things that it's, it is okay to have these kinds of things sat on a risk register and you just say, "That's a low risk, medium risk, it's acceptable," you know, we don't care about it but we, b- but you still need to think about these kinds of things.
-Absolutely. -And then what you do with it is you just, you decide, is it something that I need to, to put into code to protect against? Or, is it okay to just, just to acknowledge that yes, that is something that we are aware of, but we're not worried about it being an actual concern?
Yeah. I- so the two words that we typically use in those instances is that we would say number one, it's a known, it's a known risk but it's a, it's A, it is an acceptable risk, and B, here is a compensating control. Auditors love that phrase, a compensating control which just means we're aware of this issue but we're solving it in a different way. So we would say the
compensating control is referenced user termination policy line 15, right? Where it says, uh, you know, all user terminations will happen within 15 minutes of a termination request or at the scheduled time requested by the manager. And then you, you know, you basically reference, hey, here's the pla- place where we say this is how we do it and this is why it's not a concern. That the
application handles it because our process handles it this way. Um, and so anyway, those, those are good points to bring up, especially when you're trying to do those things, SOC 1, SOC 2. If an auditor brings that up and you don't have a solution for it like in code, i- if you have a solution for it in policy, um, then that's usually good enough, so... Yeah. Yeah. -Well folks, that's all I've got. -Cool. Michael, you got any... Uh, thanks for your help on that. I, I appreciate you
thinking through that with me. Um, I think we're gonna move forward with that and I'll let you know kinda how things go, uh, on that front. But, I think it'll be good. I think it's definitely gonna be an improvement over what we've been doing. -Yeah. Yeah, I think so. -Yeah. Yeah. So... For sure. All right my friend, Episode 179 of the North Meets South web podcast is in the books. If you'd like to find show notes for this episode find them at
northmeetsouth.audio/179. If you'd like to talk to us on Twitter, on X, on all the things, hit us up @michaeldurant, @jacobbennett or @northsouthaudio. And if you liked the podcast we'd really appreciate it if you'd rate it up in your podcatcher of choice, five stars would be absolutely incredible. Folks, we hope to see you at Laracon, please say hello. We would love to talk to you in person. We don't get to see any of you. Typically, for us this feels like speaking into the
void. It feels like nobody's listening to this ever until we get there and we hear from all of you wonderful people. It's an encouragement every year to keep going- -Oh -... and keep doing it, because... I, I, I enjoy it. I think it's, it's good to know that people do listen but it's -also a very bizarre experience. -Mm-hmm. Because people know so much about you and you're like, "Hello person." Oh, that's so funny. -Yeah. -Don't let that deterr- d- don't, don't let
that deter you from doing it though, I love, love to meet the people. Um, and it's been, you know, like I said, six years since I got to meet the people. -Absolutely. -So. Except for those of you who are kind and caring enough to come all the way down to Laracon AU. One of these years I'm gonna get there folks. All right everybody. Till next time, we'll see you.