vendredi 6 novembre 2015

Authorization Policy without model

I need to authorize users on a forum. So in blade, I have @can('editPost', $post) before showing the form to reply to a topic. My PostPolicy class has a editPost method that validates to true if it's the users own post.

However, the issue appears when I want to do a simple check, like deletePost(). This checks to see if Auth::user()->isAdmin

public function deletePost(User $user) {
    return Auth::user()->isAdmin;
    // return $user->isAdmin
}

However, this won't even get called, since I'm not passing an instance of Post

My real world application is much more complicated, but I'm using isAdmin as a simple example.

I guess defining $gate->define('deletePost', 'App\Policies\PostPolicy@deletePost'); in AuthServiceProvider could work, but would end up separating my definitions and methods, and ultimately for a large app clutter the AuthServiceProvider



via Chebli Mohamed

Aucun commentaire:

Enregistrer un commentaire