How To Implement Authorization with Laravel Policies
 

Authorization is a vital aspect of any application, allowing you to control access to resources on your server. While implementing authorization can often be cumbersome and time-consuming, Laravel's policies offer a streamlined solution, making the process remarkably simple and efficient.

 

Policies serve as organized classes for managing authorization around specific model resources. For instance, consider a scenario where you have a Product model. With Laravel policies, authorizations for this resource can be neatly organized within a dedicated class.

 

Here's a step-by-step guide to implementing authorization using Laravel policies:

 

composer create-project laravel/laravel example-policy-app

cd example-policy-app
php artisan serve

php artisan make:model User --migration 
php artisan make:model Product --migration --policy

<?php

namespace App;

use Illuminate\Database\Eloquent\Model;

class User extends Model
{
    // Define fillable attributes
    protected $fillable = [
        'name', 'email', 'password',
    ];

    // Define any relationships if necessary
}

<?php

namespace App;

use Illuminate\Database\Eloquent\Model;

class Product extends Model
{
    // Define fillable attributes
    protected $fillable = [
        'title', 'price', 'user_id',
    ];

    // Define any relationships if necessary
}

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

class CreateUsersTable extends Migration
{
    /**
     * Run the migrations.
     *
     * @return void
     */
    public function up()
    {
        Schema::create('users', function (Blueprint $table) {
            $table->id();
            $table->string('name');
            $table->string('email')->unique();
            $table->timestamp('email_verified_at')->nullable();
            $table->string('password');
            $table->rememberToken();
            $table->timestamps();
        });
    }

    /**
     * Reverse the migrations.
     *
     * @return void
     */
    public function down()
    {
        Schema::dropIfExists('users');
    }
}

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

class CreateProductsTable extends Migration
{
    /**
     * Run the migrations.
     *
     * @return void
     */
    public function up()
    {
        Schema::create('products', function (Blueprint $table) {
            $table->id();
            $table->string('title');
            $table->decimal('price', 8, 2);
            $table->foreignIdFor(\App\Models\User::class, 'user_id');
            $table->timestamps();
        });
    }

    /**
     * Reverse the migrations.
     *
     * @return void
     */
    public function down()
    {
        Schema::dropIfExists('products');
    }
}

php artisan migrate

protected $policies = [
    'App\Product' => 'App\Policies\ProductPolicy',
];

<?php

namespace App\Policies;

use App\Exceptions\ForbiddenException;
use App\Models\Product;
use App\Models\User;
use Illuminate\Auth\Access\Response;

class ProductPolicy
{
    public function allowed(User $user)
    {
        return $user->hasVerifiedEmail()
            ? Response::allow()
            : throw new ForbiddenException('Email Address Not Verified');
    }

    public function view(User $user, Product $product)
    {
        return $user->id === $product->user_id
            ? Response::allow()
            : throw new ForbiddenException($user->full_name . ' with id ' . $user->id . ' is not permitted to request this resource');
    }

    public function create(User $user)
    {
        return $user->hasVerifiedEmail()
            ? Response::allow()
            : Response::deny('Email Address not verified', 401);
    }

    public function update(User $user, Product $product)
    {
        return $user->id === $product->user_id
            ? Response::allow()
            : throw new ForbiddenException($user->full_name . ' with id ' . $user->id . ' is not permitted to update this resource');
    }

    public function delete(User $user, Product $product)
    {
        return $user->id === $product->user_id
            ? Response::allow()
            : throw new ForbiddenException($user->full_name . ' with id ' . $user->id . ' is not permitted to delete this resource');
    }

    public function restore(User $user, Product $product)
    {
        if (!$user->id === $product->user_id) {
            throw new ForbiddenException($user->full_name . ' with id ' . $user->id . ' is not permitted to restore this resource');
        }

        if (!$product->trashed()) {
            throw new ForbiddenException("The requested product has a $product->status status");
        }
        return Response::allow();
    }

    public function forceDelete(User $user, Product $product)
    {
        if (!$user->id === $product->user_id) {
            throw new ForbiddenException($user->full_name . ' with id ' . $user->id . ' is not permitted to parmenently delete this resource');
        }

        if (!$product->trashed()) {
            throw new ForbiddenException("Product must be soft-deleted (archived) before it can be permanently deleted.");
        }
        return Response::allow();
    }
}

<?php

use App\Http\Controllers\ProductController;
use Illuminate\Support\Facades\Route;

/**
 * @see \App\Policies\ProductPolicy for Authorization middleware
 * @see https://laravel.com/docs/10.x/routing#route-group-controllers
 */
Route::group([
    'as' => 'product.',
    'namespace' => "\App\Http\Controllers",
    'prefix' => 'products',
    'middleware' => [
        'auth:sanctum',
    ]
], function () {

	 // Route for creating a new product
    Route::post('/', [ProductController::class, 'store']);


 	// Route for fetching all products belonging to a user
    Route::get('/users', [ProductController::class, 'index']);
    
    // Route for viewing a specific product
    
Route::get('/{product}', [ProductController::class, 'show'])->middleware('can:view,product');
    
    
// Route for updating an existing product
    

Route::put('/{product}', [ProductController::class, 'update'])->middleware('can:update,product');
    
    

// Route for soft deleting a product

    


Route::delete('/{product}', [ProductController::class, 'delete'])->middleware('can:delete,product');
 
    // Route for restoring a soft-deleted product
    Route::get('/{product}/restore', [ProductController::class, 'restore'])->middleware('can:restore,product');
    
    

// Route for permanently deleting a soft-deleted product

    Route::delete('/{product}/force', [ProductController::class, 'forceDelete'])->middleware('can:forceDelete,product');
});