You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: authorization.md
+5-36Lines changed: 5 additions & 36 deletions
Original file line number
Diff line number
Diff line change
@@ -157,47 +157,22 @@ You may continue to define additional methods on the policy as needed for the va
157
157
<aname="methods-without-models"></a>
158
158
### Methods Without Models
159
159
160
-
Some policy methods only receive the currently authenticated user and not an instance of the model they authorize. This situation is most common when authorizing `view` or `create` actions. For example, if you are creating a blog, you may wish to check if a user is authorized to view or create any posts at all.
160
+
Some policy methods only receive the currently authenticated user and not an instance of the model they authorize. This situation is most common when authorizing `create` actions. For example, if you are creating a blog, you may wish to check if a user is authorized to create any posts at all.
161
161
162
-
When defining policy methods that will not receive a model instance, such as a `create` method, you should suffix the methods with `Any`:
162
+
When defining policy methods that will not receive a model instance, such as a `create` method, it will not receive a model instance. Instead, you should define the method as only expecting the authenticated user:
163
163
164
164
/**
165
165
* Determine if the given user can create posts.
166
166
*
167
167
* @param \App\User $user
168
168
* @return bool
169
169
*/
170
-
public function createAny(User $user)
170
+
public function create(User $user)
171
171
{
172
172
//
173
173
}
174
174
175
-
When authorizing if a user can `view` a given resource, it's common to have both `view` and `viewAny` methods on your policy. This allows you to authorize that the user can view the resource in general, as well as authorize that they can view particular instances of that resource. It's perfectly acceptable to authorize that a user can view posts but cannot view a *particular* post instance:
176
-
177
-
/**
178
-
* Determine whether the user can view posts.
179
-
*
180
-
* @param App\User $user
181
-
* @return mixed
182
-
*/
183
-
public function viewAny(User $user)
184
-
{
185
-
// Return true if the user can view posts...
186
-
}
187
-
188
-
/**
189
-
* Determine whether the user can view the post.
190
-
*
191
-
* @param App\User $user
192
-
* @param App\Post $post
193
-
* @return mixed
194
-
*/
195
-
public function view(User $user, Post $post)
196
-
{
197
-
// Return true if the user can view the given post...
198
-
}
199
-
200
-
> {tip} If you used the `--model` option when generating your policy, the `viewAny`, `createAny`, and `updateAny` methods will already be defined on the policy.
175
+
> {tip} If you used the `--model` option when generating your policy, all of the relevant "CRUD" policy methods will already be defined on the generated policy.
201
176
202
177
<aname="policy-filters"></a>
203
178
### Policy Filters
@@ -232,7 +207,7 @@ Remember, some actions like `create` may not require a model instance. In these
232
207
use App\Post;
233
208
234
209
if ($user->can('create', Post::class)) {
235
-
// Executes the "createAny" method on the relevant policy...
210
+
// Executes the "create" method on the relevant policy...
236
211
}
237
212
238
213
<aname="via-middleware"></a>
@@ -256,8 +231,6 @@ Again, some actions like `create` may not require a model instance. In these sit
256
231
// The current user may create posts...
257
232
})->middleware('can:create,App\Post');
258
233
259
-
As previously noted, policy methods which do not examine a particular model instance are always suffixed with `Any`. So, in the example above, the `createAny` method on the `PostPolicy` will be used to authorize the action.
260
-
261
234
<aname="via-controller-helpers"></a>
262
235
### Via Controller Helpers
263
236
@@ -305,8 +278,6 @@ As previously discussed, some actions like `create` may not require a model inst
305
278
// The current user can create blog posts...
306
279
}
307
280
308
-
As previously noted, policy methods which do not examine a particular model instance are always suffixed with `Any`. So, in the example above, the `createAny` method on the `PostPolicy` will be used to authorize the action.
309
-
310
281
<aname="via-blade-templates"></a>
311
282
### Via Blade Templates
312
283
@@ -329,5 +300,3 @@ Like most of the other authorization methods, you may pass a class name to the `
329
300
@can('create', Post::class)
330
301
<!-- The Current User Can Create Posts -->
331
302
@endcan
332
-
333
-
As previously noted, policy methods which do not examine a particular model instance are always suffixed with `Any`. So, in the example above, the `createAny` method on the `PostPolicy` will be used to authorize the action.
0 commit comments