laravel-authorization-patterns
Learn to implement authorization in Laravel using Gates for general ability checks and Policies for model-specific access rules. This skill covers middleware integration, Blade directives for conditional rendering, and Response objects for detailed permission messages. Includes testing strategies and best practices for securing controllers and form requests.
Laravel Authorization Patterns teaches Gates for general abilities and Policies for model-based access control.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-04-19
Laravel Authorization Patterns teaches Gates for general abilities and Policies for model-based access control. Learn to implement authorization in Laravel using Gates for general ability checks and Policies for model-specific access rules. This skill covers middleware integration, Blade directives for conditional rendering, and Response objects for detailed permission messages. Includes testing strategies and best practices for securing controllers and form requests.
Use it when
- Laravel-authorization-patterns covers creating Policy classes that define methods matching your authorization needs (create, view, update.
- Laravel-authorization-patterns emphasizes checking authorization early: use middleware for route-level protection.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
iSerter/laravel-claude-agents/laravel-authorization-patterns · repository language: PHP
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are Laravel authorization patterns and how do Gates and Policies differ?
Laravel-authorization-patterns teaches two complementary authorization mechanisms. Gates are simple, closure-based checks for general abilities (e.g., "can edit posts"), while Policies are classes that organize authorization logic for specific models. Gates work well for simple, application-wide permissions; Policies excel at model-specific rules like "can user edit this post?" Both integrate seamlessly with middleware, Blade directives, and the authorize() method.
How do you implement model-based authorization with Laravel Policies?
Laravel-authorization-patterns covers creating Policy classes that define methods matching your authorization needs (create, view, update, delete). You register Policies in your AuthServiceProvider, then use them via the authorize() method in controllers or form requests. Policies receive the authenticated user and the model instance, enabling fine-grained checks like verifying a user owns a post before allowing edits. The before() method can short-circuit checks for admins.
What are the best practices for applying authorization checks in routes, controllers, and views?
Laravel-authorization-patterns emphasizes checking authorization early: use middleware for route-level protection, call authorize() in controller methods or form requests for action-level checks, and employ Blade directives (@can, @cannot) in views for conditional rendering. This layered approach prevents unauthorized access at every level. Always validate in controllers and form requests, not just views, since views can be bypassed.
How do you test authorization logic and access control in Laravel?
Laravel-authorization-patterns includes testing strategies using Laravel's testing utilities. Write tests that verify authorized users can perform actions and unauthorized users receive denials. Test both Gates and Policies with different user roles and model states. Use actingAs() to simulate authenticated users, then assert that authorize() throws AuthorizationException or that responses reflect proper access denial.
What does laravel authorization middleware do and how is it configured?
Laravel-authorization-patterns covers middleware that checks authorization before reaching controllers. Middleware can verify Gates or Policies, rejecting unauthorized requests early. Configure it in your route definitions or middleware groups to enforce consistent access control across related routes. This prevents unauthorized users from ever reaching your business logic, improving security and reducing redundant checks.
How do Blade directives and authorization response objects secure forms and requests?
Laravel-authorization-patterns teaches using @can/@cannot directives to conditionally render form fields and buttons, preventing unauthorized users from seeing restricted actions. Authorization Response objects provide detailed denial messages beyond simple true/false, enabling custom error feedback. Combine these with form request authorization to validate permissions server-side, ensuring no unauthorized data reaches your database.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Laravel Authorization Patterns
Gates for General Ability Checks
// In AuthServiceProvider or AppServiceProvider boot()
use Illuminate\Support\Facades\Gate;
Gate::define('access-admin', function (User $user) {
return $user->is_admin;
});
Gate::define('manage-settings', function (User $user) {
return $user->hasRole('admin');
});
// Usage
if (Gate::allows('access-admin')) {
// ...
}
// ✅ Abort if unauthorized
Gate::authorize('access-admin'); // Throws AuthorizationException
// ✅ Check for specific user
Gate::forUser($otherUser)->allows('access-admin');
Policies for Model-Based Authorization
```php <?php
namespace App\Policies;
use App\Models\Post; use App\Models\User; use Illuminate\Auth\Access\Response;
class PostPolicy { // Runs before all other checks - return null to fall through public function before(User $user, string $ability): ?bool { if ($user->is_super_admin) { return true; }
return null; // Fall
(truncated - see the full file via the links below)
File tree — 1 file
skills/laravel-authorization-patterns/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn Laravel authorization patterns using Gates and Policies”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill guides you through hardening Laravel applications against common vulnerabilities. Learn to configure Sanctum and Passport for secure authentication, implement role-based access control with gates and policies, enforce HTTPS, manage sessions safely, and validate passwords against compromised databases.
PHP Expert provides in-depth instruction on PHP 8+ language features including union types, named arguments, match expressions, attributes, and enums. Learn Laravel framework patterns, Composer dependency management, and object-oriented design principles for building robust applications.
Laravel Specialist guides you through building production-ready Laravel 10+ applications with type-safe Eloquent models, queue workers, API resources, and Livewire components. It enforces modern PHP 8.2+ patterns, eager loading, dependency injection, and >85% test coverage across feature and unit tests. Use it for architecting database schemas, implementing authentication flows, optimizing queries, and validating code against PSR-12 standards.
Get expert guidance on Laravel 12.x application development, from foundational concepts like routing and database migrations to advanced patterns including Eloquent relationships, API design, and authentication with Sanctum. This skill covers the full development lifecycle—models, validation, queues, dependency injection, and best practices for building scalable web applications.
This skill guides you through TDD methodology tailored for Laravel development, using Pest PHP and Laravel's testing tools. Learn the red-green-refactor cycle with Laravel-specific patterns for controllers, models, authorization, APIs, and database operations. Apply TDD consistently across features and bugfixes to build reliable Laravel applications.
Laravel Best Practices is a comprehensive reference for building scalable Laravel 13 applications, covering 31 rules organized across architecture, Eloquent patterns, controllers, validation, security, performance, and API design. Use it when structuring applications, creating models and migrations, implementing form requests, or designing APIs. Includes essential patterns for service classes, repositories, form requests, and Eloquent models.
More skills Testing (unlicensed) · eloquent-best-practices (MIT) · laravel-middleware-patterns (MIT) · laravel-tdd (MIT) · laravel-api-resource-patterns (MIT)