Policies and FormRequests

Good insight @silencebringer & @sinnbeck Thank you both for taking the time to explain things!

Although I don't like bloated looking routes in my web.php file I agree that authorization should really take place prior to any form validation. And since type-hinted FormRequests in the controller are run first it looks like using: $this->authorize('create', Artwork::class); in the controller is something I don't prefer. (too bad)

So that means I will have to authorize via middleware in the routes file. I did some experimenting via methods: ->can() and ->middleware() and need some further guidance.

To give background of app I'll provide some additional code. My policies will govern the main types of users (ACL) I'm using Spatie's laravel-permissions package of course.

• Super-Admin (using gate, policies don't apply)
• Admin
• Artist
• Guest

Admin will be able to CRUD on any artists' artwork App\Models\Artwork Artists will only be able to CRUD on their own.

#web.php
Route::middleware(['auth'])->group(function () {
	Route::get('artwork',[ArtworkController::class, 'index'] )
			->name('artworks.index');
	Route::post('artwork/{user}',[ArtworkController::class, 'create'] )
					->name('artworks.create')
					->middleware('can:create,App\Models\Artwork');
});

A Gate as recommended by docs (Laravel & Spatie) is used for Super-Admin

Users: Admin & Artist are authorized by policies

Guest is authorized by auth middlewhere

I'm wrapping all the registered-user-logic in Route::middleware(['auth'])->group(function () {... Then I'm applying individual policy middleware to each corresponding route. What I have works now, but is this the proper way to do this?

BTW: I tried applying middleware using ->can() and it did NOT work (And I don't know why):

Route::middleware(['auth'])->group(function () {
	Route::get('artwork',[ArtworkController::class, 'index'] )
								->name('artworks.index');
	Route::post('artwork/{user}',[ArtworkController::class, 'create'] )
								->name('artworks.create')
								->can('create', Artwork::class);
});

My Artwork Policy...

#ArtworkPolicy
 public function create(User $user)
    {
		//Admin: Creating artwork for self or any user
		if($user->can('create all artwork')){
			return true;
		}

		//Artist: Creating one's own artwork
		if(auth()->id() === request()->user->id){
			return $user->can('create own artwork');
		}
    }

I needed a way to prevent an Artist from creating Artwork under a different user; hence this:

if(auth()->id() === request()->user->id){ 
...

The policy didn't respect passing in a user model.

My final piece to the puzzle is the route names / conventions. This is typically no big deal if a simple web app, but with the ability of an Admin to see the index route of any user I'm at another fork in the road.

Option one is to always supply a User like:

#Passing User
Route::get('user/{user}/artworks', [ArtworkController::class, 'index'] )
   ->name('artworks.index')
   ->can('viewAny', Artwork::class);

Option two is to use query strings with only admin use to choose the desired user's index page

#Passing Query Strings
Route::get('artworks', [ArtworkController::class, 'index'] )
   ->name('artworks.index')
   ->can('viewAny', Artwork::class);

Option one is probably the most straight forward but oddly displays the user's id to them for seemingly no reason (to them). In short it makes the url longer and uglier.

Option two presents some extra if/else logic in the controller

I played around with making {user?} optional, but I didn't like that much, it's easy to easily mess up the routes as the app grows and also requires some additional if/else stuff in the controller.

Any ideas?