Guards & Policies

1
2
3
4
5
6
7
8
9
10

class PostPolicy {
    public function update(User $user, Post $post) {
        return $user->id === $post->user_id;
    }
    public function delete(User $user, Post $post) {
        return $user->id === $post->user_id || $user->role === "admin";
    }
}

Gate::define("admin", fn($user) => $user->role === "admin");

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

<?php
// config/auth.php (custom student guard)
"guards" => [
    "student" => [
        "driver" => "session",
        "provider" => "students",
    ],
],

// app/Models/Post.php
use Illuminate\Foundation\Auth\Access\Authorizable;

// app/Policies/PostPolicy.php
class PostPolicy
{
    public function update(User $user, Post $post)
    {
        return $user->id === $post->user_id;
    }

    public function delete(User $user, Post $post)
    {
        return $user->id === $post->user_id
            || $user->is_admin;
    }
}

// Usage in controller
$this->authorize("update", $post);
if ($user->can("delete", $post)) {
    // allowed
}