Admin middleware does not work properly in Laravel

It looks like you want users and admins to be completely separate entities since they don't share the same routes. In that case, I recommend setting up two distinct guards. This way, you won't need any additional middleware - Laravel's built-in auth middleware handles it for you.

// config/auth.php
'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
    'admin' => [
        'driver' => 'session',
        'provider' => 'admins',
    ],
],
'providers' => [
    'users' => [
        'driver' => 'eloquent',
        'model' => App\Models\User::class,
    ],
    'admins' => [
        'driver' => 'eloquent',
        'model' => App\Models\Admin::class,
    ],
],

// routes/web.php
Route::middleware(['auth'])->group(function () {
    // Routes for regular users
});

Route::prefix('admin')->middleware(['auth:admin'])->group(function () {
    // Routes for admins
});

To fix this, you’ll need to explicitly block admins from accessing those "normal user" routes.

✅ Here's how you can do it:

1. Create a middleware for normal users only

Let’s call it EnsureUserIsNotAdmin.

// app/Http/Middleware/EnsureUserIsNotAdmin.php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class EnsureUserIsNotAdmin
{
    public function handle(Request $request, Closure $next)
    {
        if (auth()->check() && auth()->user()->is_admin) {
            abort(403); // Forbidden
        }

        return $next($request);
    }
}

2. Register this middleware in Kernel.php

protected $middlewareAliases = [
    'auth' => \App\Http\Middleware\Authenticate::class,
    'admin' => \App\Http\Middleware\AdminCheck::class,
    'not-admin' => \App\Http\Middleware\EnsureUserIsNotAdmin::class,
];

3. Apply it to your "normal user" routes

Route::group(['middleware' => ['auth', 'verified', 'not-admin', 'no-cache']], function () {
    // Routes only for normal users
});

✅ What happens now?

• Admins will only be able to access routes with the admin middleware.

• If they try to access routes for normal users, they’ll get a 403 Forbidden error.

• Normal users will stay unaffected.