Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

panthro's avatar

Limit Spatie Query Builder relationships based on a condition?

With Spatie Query Builder I define the allowed includes:

->allowedIncludes(['roles', 'media'])

Then on the API resource I only allow roles to be sent if user is an admin:

'roles' => $this->when($request->user()?->hasRole('admin'), $this->roles)

This works and prevents general users of my API to see other user's roles. Yet, they still can request the relationship, which could add extra strain on my database.

Is there a way to limit the allowedIncludes with query builder based upon a condition? Or should this all just be handled by the API resource?

0 likes
0 replies

Please or to participate in this conversation.