Cara Buat Login Multi User dengan Laravel

composer require spatie/laravel-permission
composer require laravel/ui

php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"
php artisan migrate
php artisan ui bootstrap --auth

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::table('users', function (Blueprint $table) {
            $table->string('alamat')->nullable()->after('email');
            $table->string('no_hp', 20)->nullable()->after('alamat');
        });
    }

    public function down(): void
    {
        Schema::table('users', function (Blueprint $table) {
            $table->dropColumn(['alamat', 'no_hp']);
        });
    }
};

<?php

namespace App\Models;

use Database\Factories\UserFactory;
use Illuminate\Database\Eloquent\Attributes\Fillable;
use Illuminate\Database\Eloquent\Attributes\Hidden;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Spatie\Permission\Traits\HasRoles;

#[Fillable(['name', 'email', 'alamat', 'no_hp', 'password'])]
#[Hidden(['password', 'remember_token'])]
class User extends Authenticatable
{
    /** @use HasFactory<UserFactory> */
    use HasFactory, Notifiable, HasRoles;

    protected function casts(): array
    {
        return [
            'email_verified_at' => 'datetime',
            'password' => 'hashed',
        ];
    }

    public function isAdmin(): bool
    {
        return $this->hasRole('admin');
    }
}

php artisan tinker --execute='$u=App\Models\User::where("email","[email protected]")->first(); var_dump($u->getRoleNames()->toArray()); var_dump($u->can("users.assign-role"));'

    public function run(): void
    {
        // Spatie me-cache permission — reset dulu agar seed selalu segar.
        app(PermissionRegistrar::class)->forgetCachedPermissions();

        // 1. Permission: "boleh melakukan APA".
        $permissions = [
            'users.view',
            'users.create',
            'users.update',
            'users.delete',
            'users.assign-role',
        ];

        foreach ($permissions as $name) {
            Permission::firstOrCreate(['name' => $name, 'guard_name' => 'web']);
        }

        // 2. Role: "SIAPA" + tempeli permission-nya.
        $adminRole = Role::firstOrCreate(['name' => 'admin', 'guard_name' => 'web']);
        $adminRole->syncPermissions($permissions);

        $userRole = Role::firstOrCreate(['name' => 'user', 'guard_name' => 'web']);
        $userRole->syncPermissions(['users.view', 'users.update']);

        // 3. Akun demo + tempel role-nya.
        $admin = User::updateOrCreate(
            ['email' => '[email protected]'],
            [
                'name' => 'Admin Demo',
                'alamat' => 'Jl. Admin No. 1',
                'no_hp' => '081234567890',
                'password' => 'password',
            ]
        );
        $admin->syncRoles(['admin']);

        $user = User::updateOrCreate(
            ['email' => '[email protected]'],
            [
                'name' => 'User Demo',
                'alamat' => 'Jl. User No. 2',
                'no_hp' => '089876543210',
                'password' => 'password',
            ]
        );
        $user->syncRoles(['user']);
    }

    protected function validator(array $data)
    {
        return Validator::make($data, [
            'name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'string', 'email', 'max:255', 'unique:users'],
            'alamat' => ['nullable', 'string', 'max:255'],
            'no_hp' => ['nullable', 'string', 'max:20'],
            'password' => ['required', 'string', 'min:8', 'confirmed'],
        ]);
    }

    protected function create(array $data)
    {
        $user = User::create([
            'name' => $data['name'],
            'email' => $data['email'],
            'alamat' => $data['alamat'] ?? null,
            'no_hp' => $data['no_hp'] ?? null,
            'password' => $data['password'],
        ]);

        $user->assignRole('user');

        return $user;
    }

class UserController extends Controller
{
    public function __construct()
    {
        // Semua method di sini wajib login dulu. Belum login → dilempar
        // ke halaman /login otomatis oleh middleware 'auth'.
        $this->middleware('auth');
    }

    public function index(): View
    {
        $currentUser = auth()->user();

        if (! $currentUser->can('users.view')) {
            abort(403, 'Kamu tidak boleh melihat data user.');
        }

        $users = $currentUser->hasRole('admin')
            ? User::with('roles')->latest()->paginate(10)
            : User::with('roles')->where('id', $currentUser->id)->paginate(10);

        return view('users.index', compact('users'));
    }

    public function create(): View
    {
        if (! auth()->user()->hasRole('admin')) {
            abort(403, 'Hanya admin yang boleh menambah user.');
        }

        return view('users.create');
    }

    public function store(Request $request): RedirectResponse
    {
        if (! auth()->user()->hasRole('admin')) {
            abort(403, 'Hanya admin yang boleh menambah user.');
        }

        $data = $request->validate([
            'name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'string', 'email', 'max:255', 'unique:users,email'],
            'alamat' => ['nullable', 'string', 'max:255'],
            'no_hp' => ['nullable', 'string', 'max:20'],
            'password' => ['required', 'string', 'min:8', 'confirmed'],
            'role' => ['required', 'in:admin,user'],
        ]);

        $user = User::create([
            'name' => $data['name'],
            'email' => $data['email'],
            'alamat' => $data['alamat'] ?? null,
            'no_hp' => $data['no_hp'] ?? null,
            'password' => $data['password'],
        ]);

        $user->assignRole($data['role']);

        return redirect()->route('users.index')->with('sukses', 'User berhasil ditambahkan.');
    }

    public function edit(User $user): View
    {
        $currentUser = auth()->user();

        if (! $currentUser->can('users.update')) {
            abort(403, 'Kamu tidak boleh mengedit data user.');
        }

        if (! $currentUser->hasRole('admin') && $currentUser->id !== $user->id) {
            abort(403, 'Kamu hanya boleh mengedit data milikmu sendiri.');
        }

        return view('users.edit', compact('user'));
    }

    public function update(Request $request, User $user): RedirectResponse
    {
        $currentUser = auth()->user();

        if (! $currentUser->can('users.update')) {
            abort(403, 'Kamu tidak boleh mengedit data user.');
        }

        if (! $currentUser->hasRole('admin') && $currentUser->id !== $user->id) {
            abort(403, 'Kamu hanya boleh mengedit data milikmu sendiri.');
        }

        $aturanRole = $currentUser->can('users.assign-role')
            ? ['required', 'in:admin,user']
            : ['prohibited'];

        $data = $request->validate([
            'name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'string', 'email', 'max:255', Rule::unique('users')->ignore($user->id)],
            'alamat' => ['nullable', 'string', 'max:255'],
            'no_hp' => ['nullable', 'string', 'max:20'],
            'password' => ['nullable', 'string', 'min:8', 'confirmed'],
            'role' => $aturanRole,
        ], [
            'role.prohibited' => 'Kamu tidak boleh mengubah role.',
        ]);

        $user->fill([
            'name' => $data['name'],
            'email' => $data['email'],
            'alamat' => $data['alamat'] ?? null,
            'no_hp' => $data['no_hp'] ?? null,
        ]);

        if (! empty($data['password'])) {
            $user->password = $data['password'];
        }

        $user->save();

        if ($currentUser->can('users.assign-role')) {
            $roleBaru = $data['role'];

            if ($user->hasRole('admin') && $roleBaru !== 'admin') {
                if ($user->id === $currentUser->id) {
                    return back()->withErrors(['role' => 'Tidak bisa menurunkan role akunmu sendiri.'])->withInput();
                }

                if (User::role('admin')->count() <= 1) {
                    return back()->withErrors(['role' => 'Tidak bisa: ini admin terakhir.'])->withInput();
                }
            }

            $user->syncRoles([$roleBaru]);
        }

        return redirect()->route('users.index')->with('sukses', 'Data user berhasil diperbarui.');
    }

    public function destroy(User $user): RedirectResponse
    {
        $currentUser = auth()->user();

        if (! $currentUser->can('users.delete')) {
            abort(403, 'Hanya admin yang boleh menghapus user.');
        }

        if ($currentUser->id === $user->id) {
            abort(403, 'Tidak boleh menghapus akunmu sendiri.');
        }

        if ($user->hasRole('admin') && User::role('admin')->count() <= 1) {
            abort(403, 'Tidak boleh menghapus admin terakhir.');
        }

        $user->delete();

        return redirect()->route('users.index')->with('sukses', 'User berhasil dihapus.');
    }

use App\Http\Controllers\UserController;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Route;

Route::get('/', function () {
    return auth()->check()
        ? redirect()->route('dashboard')
        : redirect()->route('login');
});

Auth::routes();

Route::middleware('auth')->group(function () {
    Route::redirect('/home', '/dashboard');

    Route::get('/dashboard', function () {
        return view('dashboard');
    })->name('dashboard');

    Route::get('/users', [UserController::class, 'index'])->name('users.index');
    Route::get('/users/create', [UserController::class, 'create'])->name('users.create');
    Route::post('/users', [UserController::class, 'store'])->name('users.store');
    Route::get('/users/{user}/edit', [UserController::class, 'edit'])->name('users.edit');
    Route::put('/users/{user}', [UserController::class, 'update'])->name('users.update');
    Route::delete('/users/{user}', [UserController::class, 'destroy'])->name('users.destroy');
});

<link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet">

use Illuminate\Pagination\Paginator;

    public function boot(): void
    {
        Paginator::useBootstrapFive();
    }

    protected function setUp(): void
    {
        parent::setUp();

        foreach (['users.view', 'users.create', 'users.update', 'users.delete', 'users.assign-role'] as $name) {
            Permission::firstOrCreate(['name' => $name, 'guard_name' => 'web']);
        }

        Role::firstOrCreate(['name' => 'admin', 'guard_name' => 'web'])
            ->syncPermissions(['users.view', 'users.create', 'users.update', 'users.delete', 'users.assign-role']);
        Role::firstOrCreate(['name' => 'user', 'guard_name' => 'web'])
            ->syncPermissions(['users.view', 'users.update']);

        $this->admin = User::factory()->create(['email' => '[email protected]']);
        $this->admin->assignRole('admin');

        $this->user = User::factory()->create(['email' => '[email protected]']);
        $this->user->assignRole('user');
    }

    public function test_user_biasa_bisa_edit_data_sendiri_tapi_tidak_bisa_ubah_role(): void
    {
        // Edit nama sendiri = boleh.
        $this->actingAs($this->user)
            ->put("/users/{$this->user->id}", [
                'name' => 'Nama Baru',
                'email' => '[email protected]',
            ])
            ->assertRedirect('/users');

        // Menyelipkan role=admin = DITOLAK validasi (aturan prohibited),
        // dan role tetap 'user'.
        $this->actingAs($this->user)
            ->put("/users/{$this->user->id}", [
                'name' => 'Nama Baru',
                'email' => '[email protected]',
                'role' => 'admin',
            ])
            ->assertSessionHasErrors('role');

        $this->assertTrue($this->user->fresh()->hasRole('user'));
        $this->assertFalse($this->user->fresh()->hasRole('admin'));
    }

    public function test_register_dengan_role_admin_tetap_jadi_user(): void
    {
        $this->post('/register', [
            'name' => 'Pendaftar Nekat',
            'email' => '[email protected]',
            'password' => 'password123',
            'password_confirmation' => 'password123',
            'role' => 'admin', // ← diselipkan manual, harus diabaikan
        ]);

        $pendaftar = User::where('email', '[email protected]')->first();
        $this->assertNotNull($pendaftar);
        $this->assertTrue($pendaftar->hasRole('user'));
        $this->assertFalse($pendaftar->hasRole('admin'));
    }

cd laravel
composer install
php artisan migrate --seed
php artisan serve   # buka http://127.0.0.1:8000