Sanctum, Abilities, Roles and Permissions
This is more a question of "best practices" rather than giving a code solution (which I'm not after).
I'm in the process of developing a web application accompanied by a mobile app. I was looking into Sanctum and the possibility of passing abilities when creating a Token.
Given that I'll be using Role, Permissions (spatie/laravel-permission package) and Policies for the web app, is it recommended to relie on the same authorisation checks also for the mobile or should I make different policies?
For example, let's say that I have a policy to limit the creation of posts to users having the role of editor with permission create post. Should I grant the same permission/ability to the token associated to that same user on the mobile app and on the same policy check if $request->expectsJson()then check the token capabilities, otherwise check the user's roles and permissions?
Would this be the right approach or is it better to separate the token based logic (and policies) from the web based one?
Please or to participate in this conversation.