php 50 lines · 7 steps

How authorization policies gate updates in Laravel

A PostPolicy decides who may edit a post, and the controller defers to it before saving any changes.

Explained by highlit
Laravel Intermediate authorization policies access control separation of concerns
1<?php
2 
3namespace App\Policies;
4 
5use App\Models\Post;
6use App\Models\User;
7use Illuminate\Auth\Access\Response;
8 
9class PostPolicy
10{
11 public function update(User $user, Post $post): Response
12 {
13 if ($user->id === $post->user_id) {
14 return Response::allow();
15 }
16 
17 if ($user->isEditor() && $post->team_id === $user->team_id) {
18 return Response::allow();
19 }
20 
21 return $post->published
22 ? Response::deny('Published posts can only be edited by their author.')
23 : Response::deny('You do not own this post.');
24 }
25 
26 public function before(User $user, string $ability): ?bool
27 {
28 return $user->isAdministrator() ? true : null;
29 }
30}
31 
32namespace App\Http\Controllers;
33 
34use App\Http\Requests\UpdatePostRequest;
35use App\Models\Post;
36use Illuminate\Http\RedirectResponse;
37 
38class PostController extends Controller
39{
40 public function update(UpdatePostRequest $request, Post $post): RedirectResponse
41 {
42 $this->authorize('update', $post);
43 
44 $post->update($request->validated());
45 
46 return redirect()
47 ->route('posts.show', $post)
48 ->with('status', 'Post updated.');
49 }
50}
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1Centralizing access rules in a policy keeps authorization logic out of your controllers.
  2. 2Returning Response::deny with a message gives users a clear reason instead of a bare 403.
  3. 3A before hook lets you grant blanket access to privileged roles without touching every method.

Related explainers

javascript 
const ROLE_PERMISSIONS = {
  admin: ['users:read', 'users:write', 'billing:read', 'billing:write'],
  manager: ['users:read', 'billing:read'],
  member: ['users:read'],

Role-based permissions middleware in Express

authorization middleware rbac
Intermediate 9 steps
php 
<?php
 
namespace App\Console\Commands;
 

Releasing stale document locks in Laravel

artisan-command transactions row-locking
Intermediate 6 steps
php 
<?php
 
namespace App\Providers;
 

Subdomain multi-tenancy routing in Laravel

multi-tenancy service-container route-binding
Advanced 7 steps
php 
<?php
 
namespace App\Broadcasting;
 

Authorizing presence channels in Laravel

broadcasting authorization presence-channels
Intermediate 3 steps
php 
<?php
 
namespace App\Http\Middleware;
 

Resolving the current team in Laravel middleware

middleware multi-tenancy cookies
Intermediate 8 steps
php 
<?php
 
namespace App\Http\Controllers;
 

Broadcasting typing indicators in Laravel

websockets authorization presence-channels
Intermediate 9 steps

Share this explainer

Here's the card — post it anywhere.

How authorization policies gate updates in Laravel — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code