السياسات وتفويض الموارد

<?php
namespace App\Policies;
use App\Models\Post;
use App\Models\User;
class PostPolicy
{
    public function create(User $user): bool
    {
        return $user->exists;
    }
    public function update(User $user, Post $post): bool
    {
        return (string) $user->getAuthIdentifier() === (string) $post->user_id;
    }
}

Synthetic Post user_id=7: User id=7 allowed; User id=9 denied.

استخدم الاكتشاف الاصطلاحي أو الربط الصريح؛ يسمح للمؤلف المحفوظ بتعديل منشوره ويرفض غيره.

<?php
namespace App\Http\Controllers;
use App\Models\Post;
use Illuminate\Http\Request;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Gate;
class UpdatePostController extends Controller
{
    public function update(Request $request, Post $post): RedirectResponse
    {
        Gate::authorize("update", $post);
        $data = $request->validate([
            "title" => ["required", "string", "max:120"],
            "body" => ["required", "string", "max:5000"],
        ]);
        $post->update(["title" => $data["title"], "body" => $data["body"]]);
        return redirect()->route("posts.show", $post);
    }
}

Authenticated non-author: 403 and unchanged post. Valid author request: update then redirect.

يتطلب المسار والسياسة والمخطط؛ يسبق المنع التعديل ولا يكتب إلا الحقلين.