{"id":36523,"date":"2025-12-19T09:30:49","date_gmt":"2025-12-19T06:30:49","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/laravel-ve-next-js-ile-rol-tabanli-erisim-kontrolunu-rbac-ustalasmak\/"},"modified":"2025-12-19T09:30:49","modified_gmt":"2025-12-19T06:30:49","slug":"laravel-ve-next-js-ile-rol-tabanli-erisim-kontrolunu-rbac-ustalasmak","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/laravel-ve-next-js-ile-rol-tabanli-erisim-kontrolunu-rbac-ustalasmak\/","title":{"rendered":"Laravel ve Next.js ile Rol Tabanl\u0131 Eri\u015fim Kontrol\u00fcn\u00fc (RBAC) Ustala\u015fmak"},"content":{"rendered":"

Laravel ve Next.js ile Rol Tabanl\u0131 Eri\u015fim Kontrol\u00fcn\u00fc (RBAC) Ustala\u015fmak<\/h2>\n

G\u00fcn\u00fcm\u00fcz web uygulamalar\u0131nda kullan\u0131c\u0131 deneyimi kadar g\u00fcvenlik de b\u00fcy\u00fck \u00f6nem ta\u015f\u0131maktad\u0131r. \u00d6zellikle farkl\u0131 yetkilere sahip kullan\u0131c\u0131 gruplar\u0131n\u0131n oldu\u011fu uygulamalarda, kimin hangi kayna\u011fa eri\u015febilece\u011fini, hangi i\u015flemi yapabilece\u011fini belirlemek kritik bir ihtiya\u00e7t\u0131r. \u0130\u015fte bu noktada Rol Tabanl\u0131 Eri\u015fim Kontrol\u00fc (RBAC) devreye girer. Bu makalede, modern web geli\u015ftirmenin iki g\u00fc\u00e7l\u00fc arac\u0131 olan Laravel ve Next.js kullanarak kapsaml\u0131 bir RBAC sistemini nas\u0131l kuraca\u011f\u0131n\u0131z\u0131, y\u00f6netece\u011finizi ve ustala\u015faca\u011f\u0131n\u0131z\u0131 detayl\u0131 bir \u015fekilde inceleyece\u011fiz. G\u00fcvenli, \u00f6l\u00e7eklenebilir ve kullan\u0131c\u0131 dostu uygulamalar in\u015fa etmek i\u00e7in bu k\u0131lavuz size yol g\u00f6sterecek.<\/p>\n

1. Rol Tabanl\u0131 Eri\u015fim Kontrol\u00fc (RBAC) Nedir ve Neden \u00d6nemlidir?<\/h2>\n

Rol Tabanl\u0131 Eri\u015fim Kontrol\u00fc (RBAC), bir sistemdeki kaynaklara eri\u015fimi, kullan\u0131c\u0131n\u0131n belirli bir rol veya role atanm\u0131\u015f yetkiler arac\u0131l\u0131\u011f\u0131yla d\u00fczenleyen bir g\u00fcvenlik mekanizmas\u0131d\u0131r. Bu model, kullan\u0131c\u0131lar\u0131 do\u011frudan yetkilendirmek yerine, onlar\u0131 rollerle ili\u015fkilendirerek y\u00f6netim karma\u015f\u0131kl\u0131\u011f\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r ve g\u00fcvenli\u011fi art\u0131r\u0131r.<\/p>\n

1.1. RBAC Temelleri: Kullan\u0131c\u0131lar, Roller ve \u0130zinler<\/h3>\n

RBAC modeli \u00fc\u00e7 temel bile\u015fen \u00fczerine kuruludur:<\/p>\n

* Kullan\u0131c\u0131lar (Users):<\/strong> Sisteme giri\u015f yapan ve belirli i\u015flemleri ger\u00e7ekle\u015ftirmek isteyen bireylerdir.
\n* Roller (Roles):<\/strong> Benzer yetkilere sahip kullan\u0131c\u0131 gruplar\u0131n\u0131 temsil eden mant\u0131ksal yap\u0131lard\u0131r. \u00d6rne\u011fin, “Y\u00f6netici”, “Edit\u00f6r”, “\u00dcye” gibi roller olabilir. Bir kullan\u0131c\u0131 birden fazla role sahip olabilir.
\n* \u0130zinler (Permissions):<\/strong> Bir kullan\u0131c\u0131n\u0131n (rol\u00fc arac\u0131l\u0131\u011f\u0131yla) belirli bir kayna\u011fa eri\u015fme veya belirli bir i\u015flemi ger\u00e7ekle\u015ftirme yetkisini tan\u0131mlar. \u00d6rne\u011fin, “makale_olu\u015ftur”, “kullan\u0131c\u0131_sil”, “ayarlar\u0131_g\u00f6r\u00fcnt\u00fcle” gibi izinler olabilir.<\/p>\n

Bu yap\u0131 sayesinde, bir kullan\u0131c\u0131n\u0131n yetkileri de\u011fi\u015fti\u011finde, do\u011frudan kullan\u0131c\u0131ya atanan izinleri g\u00fcncellemek yerine, sadece rol\u00fcn\u00fc de\u011fi\u015ftirmek veya rol\u00fcn izinlerini g\u00fcncellemek yeterli olur. Bu, \u00f6zellikle b\u00fcy\u00fck sistemlerde y\u00f6netim y\u00fck\u00fcn\u00fc azalt\u0131r.<\/p>\n

1.2. RBAC’nin Avantajlar\u0131 ve Dezavantajlar\u0131<\/h3>\n

Avantajlar\u0131:<\/strong><\/p>\n

* Y\u00f6netim Kolayl\u0131\u011f\u0131:<\/strong> Kullan\u0131c\u0131 baz\u0131nda de\u011fil, rol baz\u0131nda yetki y\u00f6netimi, \u00f6zellikle \u00e7ok say\u0131da kullan\u0131c\u0131 ve izin oldu\u011funda b\u00fcy\u00fck kolayl\u0131k sa\u011flar.
\n* \u00d6l\u00e7eklenebilirlik:<\/strong> Yeni kullan\u0131c\u0131lar eklendi\u011finde veya yetkiler de\u011fi\u015fti\u011finde, mevcut rolleri kullanarak sistemi kolayca geni\u015fletebilirsiniz.
\n* G\u00fcvenlik:<\/strong> Kullan\u0131c\u0131lar\u0131n sadece ihtiya\u00e7 duyduklar\u0131 yetkilere sahip olmas\u0131n\u0131 sa\u011flayarak “en az ayr\u0131cal\u0131k” ilkesini destekler. Bu, g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n potansiyel etkisini azalt\u0131r.
\n* \u015eeffafl\u0131k:<\/strong> Kimin neye eri\u015febilece\u011fi, roller arac\u0131l\u0131\u011f\u0131yla daha net bir \u015fekilde g\u00f6r\u00fclebilir.<\/p>\n

Dezavantajlar\u0131:<\/strong><\/p>\n

* \u0130lk Kurulum Karma\u015f\u0131kl\u0131\u011f\u0131:<\/strong> Ba\u015flang\u0131\u00e7ta rollerin ve izinlerin do\u011fru \u015fekilde tasarlanmas\u0131 zaman alabilir.
\n* \u00c7ok Detayl\u0131 Kontrolde Zorluk:<\/strong> \u00c7ok ince taneli (fine-grained) eri\u015fim kontrol\u00fc gerekti\u011finde (\u00f6rne\u011fin, “sadece kendi olu\u015fturdu\u011fu makaleyi d\u00fczenleyebilir”), RBAC tek ba\u015f\u0131na yetersiz kalabilir ve Nitelik Tabanl\u0131 Eri\u015fim Kontrol\u00fc (ABAC) gibi modellerle birle\u015ftirilmesi gerekebilir.<\/p>\n

1.3. Di\u011fer Eri\u015fim Kontrol Modelleriyle Kar\u015f\u0131la\u015ft\u0131rma<\/h3>\n

* Discretionary Access Control (DAC):<\/strong> Kaynak sahibinin, kaynaklar\u0131na kimin eri\u015febilece\u011fine karar verdi\u011fi modeldir. Basit sistemler i\u00e7in uygun olsa da, b\u00fcy\u00fck ve karma\u015f\u0131k sistemlerde y\u00f6netimi zordur.
\n* Mandatory Access Control (MAC):<\/strong> Sistem y\u00f6neticisinin merkezi olarak t\u00fcm eri\u015fim politikalar\u0131n\u0131 belirledi\u011fi modeldir. Y\u00fcksek g\u00fcvenlik gerektiren askeri veya devlet sistemlerinde kullan\u0131l\u0131r. Kullan\u0131c\u0131lar\u0131n kendi eri\u015fim haklar\u0131n\u0131 de\u011fi\u015ftirmesine izin vermez.
\n* Attribute-Based Access Control (ABAC):<\/strong> Kullan\u0131c\u0131, kaynak, ortam ve eylem niteliklerine (attribute) dayal\u0131 dinamik eri\u015fim kararlar\u0131 veren en esnek modeldir. “Kullan\u0131c\u0131, mesai saatleri i\u00e7inde ve belirli bir IP adresinden ba\u011flan\u0131yorsa, \u015fu belgeye eri\u015febilir” gibi senaryolar\u0131 y\u00f6netebilir. RBAC’ye g\u00f6re daha karma\u015f\u0131kt\u0131r ancak daha esnektir. RBAC genellikle ABAC’nin bir alt k\u00fcmesi veya ba\u015flang\u0131\u00e7 noktas\u0131 olarak g\u00f6r\u00fclebilir.<\/p>\n

2. Laravel’de RBAC Uygulamak: Spatie Laravel-Permission Paketi<\/h2>\n

Laravel ekosisteminde RBAC uygulamak i\u00e7in en pop\u00fcler ve sa\u011flam \u00e7\u00f6z\u00fcmlerden biri Spatie’nin laravel-permission<\/code> paketidir. Bu paket, rolleri ve izinleri veritaban\u0131nda y\u00f6netmenize, kullan\u0131c\u0131lara ataman\u0131za ve eri\u015fim kontrollerini kolayca ger\u00e7ekle\u015ftirmenize olanak tan\u0131r.<\/p>\n

2.1. Kurulum ve Temel Yap\u0131land\u0131rma<\/h3>\n

\u00d6ncelikle, Laravel projenize paketi kurmal\u0131s\u0131n\u0131z:<\/p>\n

composer require spatie\/laravel-permission<\/pre>\n
<\/code><\/p>\n
Ard\u0131ndan, paketin migration dosyalar\u0131n\u0131 yay\u0131mlay\u0131n ve veritaban\u0131n\u0131 g\u00fcncelleyin:<\/p>\n
php artisan vendor:publish --provider=\"Spatie\\Permission\\PermissionServiceProvider\" --tag=\"permission-migrations\"\nphp artisan migrate<\/pre>\n
<\/code><\/p>\n
Bu komutlar, roles<\/code> ve permissions<\/code> tablolar\u0131n\u0131 ve ara tablolar\u0131 (model_has_roles<\/code>, model_has_permissions<\/code>, role_has_permissions<\/code>) olu\u015fturacakt\u0131r.<\/p>\n
Son olarak, User<\/code> modelinize HasRoles<\/code> trait'ini ekleyin:<\/p>\n
\/\/ app\/Models\/User.php\nnamespace App\\Models;\n\nuse Illuminate\\Contracts\\Auth\\MustVerifyEmail;\nuse Illuminate\\Database\\Eloquent\\Factories\\HasFactory;\nuse Illuminate\\Foundation\\Auth\\User as Authenticatable;\nuse Illuminate\\Notifications\\Notifiable;\nuse Laravel\\Sanctum\\HasApiTokens;\nuse Spatie\\Permission\\Traits\\HasRoles; \/\/ Bu sat\u0131r\u0131 ekleyin\n\nclass User extends Authenticatable\n{\n    use HasApiTokens, HasFactory, Notifiable, HasRoles; \/\/ Buraya HasRoles ekleyin\n\n    \/\/ ... di\u011fer model \u00f6zellikleri\n}<\/pre>\n
<\/code><\/p>\n
2.2. Rol ve \u0130zin Tan\u0131mlama<\/h3>\n
Rolleri ve izinleri veritaban\u0131na eklemek i\u00e7in Tinkerwell veya bir seeder kullanabilirsiniz:<\/p>\n
\/\/ database\/seeders\/RolesAndPermissionsSeeder.php\nuse Illuminate\\Database\\Seeder;\nuse Spatie\\Permission\\Models\\Role;\nuse Spatie\\Permission\\Models\\Permission;\n\nclass RolesAndPermissionsSeeder extends Seeder\n{\n    public function run()\n    {\n        \/\/ \u00d6nbelle\u011fi temizle\n        app()[\\Spatie\\Permission\\PermissionRegistrar::class]->forgetCachedPermissions();\n\n        \/\/ \u0130zinleri olu\u015ftur\n        Permission::create(['name' => 'edit articles']);\n        Permission::create(['name' => 'delete articles']);\n        Permission::create(['name' => 'publish articles']);\n        Permission::create(['name' => 'view admin panel']);\n        Permission::create(['name' => 'manage users']);\n\n        \/\/ Rolleri olu\u015ftur ve izinleri ata\n        $roleAdmin = Role::create(['name' => 'admin']);\n        $roleAdmin->givePermissionTo(Permission::all()); \/\/ T\u00fcm izinleri admin'e ver\n\n        $roleEditor = Role::create(['name' => 'editor']);\n        $roleEditor->givePermissionTo(['edit articles', 'publish articles']);\n\n        $roleViewer = Role::create(['name' => 'viewer']);\n        $roleViewer->givePermissionTo(['view admin panel']);\n    }\n}<\/pre>\n
<\/code><\/p>\n
Seeder'\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n: php artisan db:seed --class=RolesAndPermissionsSeeder<\/code><\/p>\n
2.3. Kullan\u0131c\u0131lara Rol ve \u0130zin Atama<\/h3>\n
Bir kullan\u0131c\u0131ya rol veya do\u011frudan izin atamak \u00e7ok kolayd\u0131r:<\/p>\n
$user = App\\Models\\User::find(1);\n\n\/\/ Kullan\u0131c\u0131ya 'admin' rol\u00fcn\u00fc ata\n$user->assignRole('admin');\n\n\/\/ Kullan\u0131c\u0131ya do\u011frudan 'delete articles' iznini ver (rol\u00fc olmasa bile)\n$user->givePermissionTo('delete articles');\n\n\/\/ Kullan\u0131c\u0131n\u0131n rol\u00fcn\u00fc kontrol et\nif ($user->hasRole('admin')) {\n    \/\/ ...\n}\n\n\/\/ Kullan\u0131c\u0131n\u0131n iznini kontrol et\nif ($user->can('edit articles')) {\n    \/\/ ...\n}\n\n\/\/ Bir rolden izinleri kald\u0131r\n$roleEditor->revokePermissionTo('publish articles');\n\n\/\/ Bir kullan\u0131c\u0131dan rol\u00fc kald\u0131r\n$user->removeRole('admin');<\/pre>\n
<\/code><\/p>\n
2.4. Middleware ve Blade Direktifleri ile Eri\u015fim Kontrol\u00fc<\/h3>\n
Laravel'de rota ve view seviyesinde eri\u015fim kontrol\u00fc i\u00e7in middleware ve Blade direktiflerini kullanabilirsiniz.<\/p>\n
Middleware ile Rota Korumas\u0131:<\/strong><\/p>\n
web.php<\/code> veya api.php<\/code> rotalar\u0131n\u0131za middleware ekleyin:<\/p>\n
\/\/ Sadece 'admin' rol\u00fcne sahip kullan\u0131c\u0131lar eri\u015febilir\nRoute::group(['middleware' => ['role:admin']], function () {\n    Route::get('\/admin\/dashboard', [AdminController::class, 'dashboard']);\n});\n\n\/\/ 'edit articles' iznine sahip kullan\u0131c\u0131lar eri\u015febilir\nRoute::middleware(['permission:edit articles'])->group(function () {\n    Route::get('\/articles\/{article}\/edit', [ArticleController::class, 'edit']);\n});\n\n\/\/ Birden fazla rol veya izin i\u00e7in\nRoute::middleware(['role:admin|editor', 'permission:publish articles'])->group(function () {\n    Route::get('\/articles\/publish-queue', [ArticleController::class, 'publishQueue']);\n});<\/pre>\n
<\/code><\/p>\n
Blade Direktifleri ile UI Korumas\u0131:<\/strong><\/p>\n
View dosyalar\u0131n\u0131zda, kullan\u0131c\u0131 yetkilerine g\u00f6re UI elementlerini gizleyip g\u00f6sterebilirsiniz:<\/p>\n
\n@role('admin')\n    Y\u00f6netici Ayarlar\u0131<\/a>\n@endrole\n\n\n@can('edit articles')\n