What's the best way to show the toolbar only to users with certain roles?
Dont know about the best, but the easiest is probably to use diazo rules
I need a permission based solution
You may want to override the toolbar viewlet manager registration or its class:
The body tag defines all user roles as CSS classes
userrole-manager userrole-authenticated userrole-owner
So you could hide the toolbar perhaps based on these classes or their non-existence?
sorry for the late reply...
Different permission on the viewletManager, still leaves the toolbar specific body classes present
https://github.com/plone/plone.app.layout/pull/122 allows this now, based on the users role in context
Well, it allows it by subclassing or by patching the global variable. A registry entry would be good to make it easier. Anyway, this can be extended in future.