Global policy or gate for every resource

To achieve a global policy or gate for every resource in a Laravel application, you can use a combination of route model binding, middleware, and a single gate or policy method that checks the team ownership of the bound model. Here's a step-by-step solution:

1. Define a Gate or Policy Method: First, define a gate or policy method that checks if the authenticated user is a member of the team that owns the resource.

   // In AuthServiceProvider or any service provider you prefer
   
   use Illuminate\Support\Facades\Gate;
   
   public function boot()
   {
       // ...
   
       Gate::define('view-team-resource', function ($user, $resource) {
           return $user->team_id === $resource->team_id;
       });
   }
   

2. Create a Middleware: Create a middleware that will extract the resource from the route and check the gate for the given resource.

   // Run `php artisan make:middleware CheckTeamOwnership`
   
   namespace App\Http\Middleware;
   
   use Closure;
   use Illuminate\Support\Facades\Gate;
   
   class CheckTeamOwnership
   {
       public function handle($request, Closure $next)
       {
           $routeParameters = $request->route()->parameters();
   
           foreach ($routeParameters as $parameter) {
               if (is_object($parameter) && method_exists($parameter, 'team')) {
                   if (Gate::denies('view-team-resource', $parameter)) {
                       abort(403);
                   }
                   break;
               }
           }
   
           return $next($request);
       }
   }
   

   In this middleware, we assume that your resources have a team() relationship method or a team_id property that can be used to check ownership.

3. Register the Middleware: Register the middleware in your app/Http/Kernel.php file.

   protected $routeMiddleware = [
       // ...
       'team.ownership' => \App\Http\Middleware\CheckTeamOwnership::class,
   ];
   

4. Apply Middleware to Routes: Apply the middleware to your resource routes. You can do this in your routes/web.php or routes/api.php file.

   Route::middleware(['auth', 'team.ownership'])->group(function () {
       // Define your resource routes here
       Route::resource('projects', 'ProjectController');
       // ... other resources
   });
   

   Ensure that your controllers use route model binding so that the middleware can automatically inject the model instance into the route.

5. Route Model Binding: If you haven't already, make sure to use route model binding in your controller methods. Laravel will automatically resolve the model instances for you.

   public function show(Project $project)
   {
       // $project is automatically resolved and injected by Laravel
       return view('projects.show', compact('project'));
   }
   

With this setup, you have a single gate that checks team ownership, and a middleware that applies this check to all routes within the group. This approach avoids the need to write repetitive logic for each resource and keeps your authorization logic centralized.