Using laravel policy to filter eloquent query

belong to the user's role

That's where the authorized users ID comes in.

public function getPets($petsearch = '')
    {
        $petsearch = $petsearch . "%";
        $query = Pet::where('petname', 'like', $petsearch);
        if (Auth::user()->role !== 'admin') {
            $userid = Auth::user()->id;
            $query->where('ownerid', '=', $userid);
        }
        $results = $query->orderBy('petname', 'asc')->paginate(5);
        return $results;
    }

So if admin show all otherwise show only the currently logged in users data.

Multiple roles:

Can write whatever method you see fit to see if a logged in user is also an admin.

I am in no way suggesting to use any of this code.

I wrote one, but do your own the way you want:

public static function userRole($role = null)
    {
        $userrole = Auth::user()->role;
        $checkrole = explode(',', $userrole);
        if (in_array($role, $checkrole)) {
            return $role;
        }
        return false;
    }

Then to use:

public function getPets($petsearch = '')
    {
        $petsearch = $petsearch . "%";
        $query = Pet::where('petname', 'like', $petsearch);
        if (ChkAuth::userRole('admin') === false) {
            $userid = Auth::user()->id;
            $query->where('ownerid', '=', $userid);
        }
        $results = $query->orderBy('petname', 'asc')->paginate(5);
        return $results;
    }

If user is admin this part

if (ChkAuth::userRole('admin') === false) {
            $userid = Auth::user()->id;
            $query->where('ownerid', '=', $userid);
        }

Is not used, since admin will see all.

Again just example of what I did, I am not saying use anything here, write your own logic.

But the key to a user seeing their own data only is:

$query->where('ownerid', '=', $userid);
// or
$query->where('user_id', '=', $userid);

Something like that.

In RBAC there are hundreds of ways to setup, I try to stay simple.

There's nothing in the docs that prevents you from writing some custom methods to check a role.

Also here's an S.O. article: https://stackoverflow.com/questions/44226475/check-if-auth-user-role-id-matches-array-in-laravel

Maybe you need global scopes? Automatically apply restrictions to your eloquent queries.

https://laravel.com/docs/5.8/eloquent#query-scopes

@JLRDW - Thank you for the detailed answer! I'm already aware of everything you mentioned and that's my current approach. I was more likely imagining something as simple as App\Document::whereCan('view')->get() to filter the documents query the way I mentioned: only get the documents which the curret user can view similarly to the way policies function (if($user->can('view', $document)). But I guess there's no such SO simple way to achieve that...

@Snapey - I already employ global scopes in mentioned filtering, I was just wondering if I could somehow combine the logic with the one defined in the policies. But it didn't make direct sense to me since policies are designed to work with loaded model instances which are backend objects and have nothing to do with the sql query, so I wondered if there's an alternative to it in terms of query building. Seems not. Thanks anyway! New ideas are still welcome!

When defining the global scope, you can refer to the policy to know if the scope should be applied or if the scope varies according to the policy.

@DAVIDPETROV - First thank you for thanking both of us.

RBAC became a little clearer to me when I pictured it like this.

Pretend you are in a large industrial complex with many rooms and many doors.

They have a maintenance department accounting department Human Resources, executives (admins).

So a user is walking through and each door either user can or cannot enter.

And me I like looking at each controller method the same way, the logged in user can or cannot do that method.

And of course the other part of RBAC as mentioned above, is to allow a user to see and edit their own data while disallowing other uses.

Even Jeffrey in one of his videos mentioned setting this stuff up can be tricky at first but once learned gets easier.