Skip to content

Commit 6876cfd

Browse files
committed
simplify docs
1 parent 16e2648 commit 6876cfd

File tree

1 file changed

+5
-36
lines changed

1 file changed

+5
-36
lines changed

authorization.md

Lines changed: 5 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -157,47 +157,22 @@ You may continue to define additional methods on the policy as needed for the va
157157
<a name="methods-without-models"></a>
158158
### Methods Without Models
159159

160-
Some policy methods only receive the currently authenticated user and not an instance of the model they authorize. This situation is most common when authorizing `view` or `create` actions. For example, if you are creating a blog, you may wish to check if a user is authorized to view or create any posts at all.
160+
Some policy methods only receive the currently authenticated user and not an instance of the model they authorize. This situation is most common when authorizing `create` actions. For example, if you are creating a blog, you may wish to check if a user is authorized to create any posts at all.
161161

162-
When defining policy methods that will not receive a model instance, such as a `create` method, you should suffix the methods with `Any`:
162+
When defining policy methods that will not receive a model instance, such as a `create` method, it will not receive a model instance. Instead, you should define the method as only expecting the authenticated user:
163163

164164
/**
165165
* Determine if the given user can create posts.
166166
*
167167
* @param \App\User $user
168168
* @return bool
169169
*/
170-
public function createAny(User $user)
170+
public function create(User $user)
171171
{
172172
//
173173
}
174174

175-
When authorizing if a user can `view` a given resource, it's common to have both `view` and `viewAny` methods on your policy. This allows you to authorize that the user can view the resource in general, as well as authorize that they can view particular instances of that resource. It's perfectly acceptable to authorize that a user can view posts but cannot view a *particular* post instance:
176-
177-
/**
178-
* Determine whether the user can view posts.
179-
*
180-
* @param App\User $user
181-
* @return mixed
182-
*/
183-
public function viewAny(User $user)
184-
{
185-
// Return true if the user can view posts...
186-
}
187-
188-
/**
189-
* Determine whether the user can view the post.
190-
*
191-
* @param App\User $user
192-
* @param App\Post $post
193-
* @return mixed
194-
*/
195-
public function view(User $user, Post $post)
196-
{
197-
// Return true if the user can view the given post...
198-
}
199-
200-
> {tip} If you used the `--model` option when generating your policy, the `viewAny`, `createAny`, and `updateAny` methods will already be defined on the policy.
175+
> {tip} If you used the `--model` option when generating your policy, all of the relevant "CRUD" policy methods will already be defined on the generated policy.
201176
202177
<a name="policy-filters"></a>
203178
### Policy Filters
@@ -232,7 +207,7 @@ Remember, some actions like `create` may not require a model instance. In these
232207
use App\Post;
233208

234209
if ($user->can('create', Post::class)) {
235-
// Executes the "createAny" method on the relevant policy...
210+
// Executes the "create" method on the relevant policy...
236211
}
237212

238213
<a name="via-middleware"></a>
@@ -256,8 +231,6 @@ Again, some actions like `create` may not require a model instance. In these sit
256231
// The current user may create posts...
257232
})->middleware('can:create,App\Post');
258233

259-
As previously noted, policy methods which do not examine a particular model instance are always suffixed with `Any`. So, in the example above, the `createAny` method on the `PostPolicy` will be used to authorize the action.
260-
261234
<a name="via-controller-helpers"></a>
262235
### Via Controller Helpers
263236

@@ -305,8 +278,6 @@ As previously discussed, some actions like `create` may not require a model inst
305278
// The current user can create blog posts...
306279
}
307280

308-
As previously noted, policy methods which do not examine a particular model instance are always suffixed with `Any`. So, in the example above, the `createAny` method on the `PostPolicy` will be used to authorize the action.
309-
310281
<a name="via-blade-templates"></a>
311282
### Via Blade Templates
312283

@@ -329,5 +300,3 @@ Like most of the other authorization methods, you may pass a class name to the `
329300
@can('create', Post::class)
330301
<!-- The Current User Can Create Posts -->
331302
@endcan
332-
333-
As previously noted, policy methods which do not examine a particular model instance are always suffixed with `Any`. So, in the example above, the `createAny` method on the `PostPolicy` will be used to authorize the action.

0 commit comments

Comments
 (0)